I think we should redirect to recovery here. All this could be handled in the existing view that should serve up the page for a valid token, and redirect to recovery otherwise.