validate account on recovery password