handle recovery password