removed password recovery for the time being (won't work on heroku without more setup)