Implement a password recovery endpoint, and a way to set the recovery hints (in the current model, it's a hint/response system).
