When using "-vault-unwrap-token" the unwrapped token should be preserved across reloads

When using the `-vault-unwrap-token` option along with either providing a token in the `VAULT_TOKEN` environment variable or via the `-vault-token` command line option will result in the token attempting to be unwrapped a second time when consul-template is reloaded via a `HUP` signal.

### Consul Template version

`v0.26.0 (3b7f233a)`

### Command

```shell
/usr/bin/consul-template -vault-token=`cat /tmp/consul-template.token` -vault-unwrap-token -config=/etc/consul-template/conf.d
```

### Debug output

https://gist.github.com/drawks/183760ae59253744179b0943ddeed611

### Expected behavior

The unwrapped token should be preserved across reloads.

### Actual behavior

When a HUP signal is received the process reloads and attempts to unwrap the wrapped token a second time which results in a 400 response and consul-template exits.

### Steps to reproduce

1. generate a wrapped token
2. start consul-template with the wrapped token provided either via the `-vault-token` command line option or via the `VAULT_TOKEN` environment variables and also with the `-vault-unwrap-token` command line option
3. send a HUP signal to the consul-template process
4. observe consul-template attempt to unwrap the wrapped token a second time and exit after receiving a 400 response from the vault server

Start at the command-line handling for `-vault-unwrap-token` and the `HUP` reload path, then trace how the token from `VAULT_TOKEN` or `-vault-token` is reused. Reproduce with a wrapped token and a reload; done means the token is not unwrapped a second time and the process remains running.

Written by the indexing model from the issue text.