recovery token was never set to None

recovery token is set to None on every password change.