extra user tests
password recovery