- **request password recovery**: send a recovery link to email - **change password**: change user password with recovery token from email