Check `validate` option before validating

Ran into an issue while trying out 3.0 today. My code:

	public function register(User &$user) {
		if ($this->validate($user)) {
			$user->password = Security::hash($user->password);
		}
		return $this->save($user, ['validate' => false]);
	}

The `save()` call would validate data again even though I passed `'validate' => false` and it would fail on password match rule because it is hashed now.

Added a check for the `validate` option.