fix(user): reset token on every save

The password reset/activate process currently depends on this behavior,
so we've re-enabled it. It would be better for the activate/reset
process to call User#resetToken manually, when they depend on a fresh
token.