issue #20445: allow users to recover forgotten passwords

I'd like to see Ben try to black-hat this before we put it into production