added password recovery without SMTP