there was no check to make sure an incoming recovery request has the right format, a rogue client could bring the app down so fixed it