there was no check to make sure an incoming recovery request has the right format, a rogue client could bring the app down so fixed it
Merge pull request #27 from AlexandreBeaulne/develop

recovery requests sanitization