Password reset should not act as OTP

for email based accounts there is a '3 step instustry standard' password reset flow: 1. user has the option to submit a "forgot password" form where they detail their email address. easy in Supabase by calling [supabase.auth.resetPasswordForEmail]( 2. the user receives the password reset email 3. upon clicking on the {{ .ConfirmationURL }}(containing reset token) in the email, the user is presented custom form to change their password. this is all standard stuff and pretty much same with any identity provider using email / password based sessions. in Supabase, however, step 3 acts as OTP and redirecting the user with confirmationURL signs them in automatically and before they've changed their password. the same is true when validting the token via SDK manually on the client. hence this _password reset_ flow effectively works as _OTP_ which is not necessarily always desired. in my instance I do want the user to manually sign in after they've succe…