Security changes for password recovery