In password recovery, don't reveal whether an e-mail address is valid (unless it is an org's e-mail address)

endpoints/api/user.py

@@ -829,7 +829,9 @@ class Recovery(ApiResource):
     email = request.get_json()['email']
     user = model.user.find_user_by_email(email)
     if not user:
-      raise model.InvalidEmailAddressException('Email address was not found.')
+      return {
+        'status': 'sent',
+      }
 
     if user.organization:
       send_org_recovery_email(user, model.organization.get_admin_users(user))