don't fabricate password recovery data