how long the old keys and vaults are kept for a restore (30)
grants on vaults the user doesn't own, including org vaults
names of orgs whose only confirmed owner/admin is this user
RFC 3339; the link stops working then (72 hours after approval)
RFC 3339; the reset link works from then on (before that the routes answer recovery_not_ready)
GET /auth/recover/{token}, camelCased: what an approved reset will do (SPEC.md §18).