public static function recover($data) {
    if (!Tilmeld::$config['pw_recovery']) {
      return [
        'result' => false,
        'message' => 'Account recovery is not allowed.'
      ];
    }

    $user = User::factory($data['username']);

    if (!isset($user->guid)
        || !isset($user->recoverSecret)
        || $data['secret'] !== $user->recoverSecret
        || strtotime(
            '+'.Tilmeld::$config['pw_recovery_time_limit'],
            $user->recoverSecretTime
        ) < time()
      ) {
      return [
        'result' => false,
        'message' => 'The secret code does not match.'
      ];
    }

    if (empty($data['password'])) {
      return ['result' => false, 'message' => 'Password cannot be empty.'];
    }

    $user->password($data['password']);
    unset($user->recoverSecret);
    unset($user->recoverSecretTime);
    if ($user->saveSkipAC()) {
      return [
        'result' => true,
        'message' => 'Your password has been reset. You can now log in using '.
          'your new password.'
      ];
    } else {
      return ['result' => false, 'message' => 'Error saving new password.'];
    }
  }