only check for recovery key if someone else than the user wants to change the password