Bug 18956: Prevent leaking during password recovery