add some instruction on password recovery