Solved.

Silly error: typo of one character that sneaked in while copy/pasting.

Ktor is doing exactly what it should do:

Sending the Token plain if you pass an empty password.