Tokens are unusable, because DrupalWebTestCase::drupalGetToken() does not use a hash salt, while drupal_get_token() does. This bug makes it impossible to test code that uses tokens.
Core does not use this method. However, I have a contrib patching waiting that does: #1550940: Extend and test payment permissions