Only set token back if password reset fails.

This prevents the digested version of the token being saved when a reset
is successful.
Merge pull request #3318 from BrentWheeldon/bugfix/clear-reset-token

Only set token back if password reset fails.