v1.3.0: setPassword with explicit recovery/step-up bearer