Avoid saving unvalidated fields

If there are any assigned attributes that are invalid, they should not be saved without validation.

This change saves only the DeviseSecurityExtension fields to prevent things like this:

```ruby
user.assign_attributes(email: "") # bad input
user.need_change_password! # would save whole model, bad input without validation
```

Also it looks like there was a recursive loop inside `need_change_password` which I removed: please check if this is correct unless I missed what that was supposed to do.