use uppercase recovery token