Unlock token in bruteforce protection is set to the model after the mail is sent

You had some errors in mailer code, so you could not see that in moment when send_unlock_token_email is sent, user.unlock_token is set to nil.