add hint about what the recovery password field is for
use pre_setPassword hook to update the encryption keys if the back-end doesn't support password change; improved output to let the admin know what happened