Do not output empty tokens

If you use a token in the redirect field and the token is not found at execute time, the token itself will be escaped and added to the redirect url. This is very undesirable if you want to use a token to prepopulate a webform field from a url query parameter, for example.

token_replace() has an option to not output empty tokens - let's use it. This should not break anything, because if the empty token was being output as a path argument that path would be broken anyway.

Patch to follow.