added password confirmation for recover functionality