Recover access

Recovery requires a verified step-up challenge and a short-lived one-time ticket.