added UserController.update(), fixed recover route