Forbid empty tokens

While the UI does not allow it, it's technically possible to create empty token right now. There is no use case where this really make sense, so let's avoid some bad code to introduce a vulnerability.