people can send password recovery requests