fixed password recovery