Use same metrics as TOS for lost password