more work on password recovery. need to redo passrecover.inc as a view