Only set token back if password reset fails.

This prevents the digested version of the token being saved when a reset is successful.
That's what I had originally, but it broke a test (namely, `test/integration/recoverable_test.rb:188`). When I looked into that test I realised just clearing it out if the record was persisted would mean that if a user messes up reseting their password (like sets the password and confirmation to different things, like in the test) the token will be cleared and they'll have to request another reset.