password recovery - incomplete