In sendPasswordRecoveryEmail, look at both parms: to and email.  Turns
out the website was sending the email address as the "to" parm, while
the mobile app was sending the email address as the "email" parm.

Made this function flexible by first looking at the "email" parm, then
if that doesn't exist, looking at the "to" parm