hacking auth
implement password recovery
password recovery works, waiting state removed