Add some recovery-related endpoints

This is related to #235. It implements GET and POST for the recover endpoint - though only wrapped around the thinnest feasible underlying implementation (in particular, not one which can recover anything - but hopefully which has the same shape as one which can).