Tests for token refresh and wrong password reset requests

[georgiana-b]

Add tests for /account/token/refresh and for the negative cases of password recovery (wrong password reset token, password - passwordConfirmation mismatch etc.)

There has been a test for token refresh but I couldn't manage to fix it in a reasonable amount of time. I did manually try the functionality and it works so it seems sensible to postpone it.