better password recovery workflow