- /email recovery generates recovery code and resets password only if recovery code is also given - Change data source method to return email and recovery code