2.22 Password recovery is well implemented

Verify that forgotten password and other recovery paths use a soft token, mobile push, or an offline recovery mechanism.

Levels: 1, 2, 3