Bug in setpassword anti-vorgery token.