encrypting recovery codes now, recreating them on download