Password recovery request now REST-compliant, random number generate doesn't require explicit salt