Add password recovery logic

Implement a password recovery endpoint, and a way to set the recovery
hints (in the current model, it's a hint/response system).