better error on /forgot-recover