So in a typical web-app scenario, the new user is sent some sort of email with a one-time, time sensitive token link which when clicked will "activate" their account or "verify" their email address.
Do we, or do we not also sign that user in (set bearer token; send auth/session cookie) at the time when we verify them via the unique link?
For clarity: assuming, no previous session in the browser where the activation link is clicked:
- If we do create a session/sign the user in, then the user is free to navigate back to the home page and throughout the app and they are not required to enter their username/password.
- If we do not create a session/sign the user in, then their account is still activated (or email verified) but any attempt to navigate into the app presents the login form and continuation requires username and password.