fixed some password recovery logic