Password reset state should be persisted in the auth token

[dsl400]

After clicking on the link received via email for password reset the onAuthStateChange emits two events, SIGNED_IN and PASSWORD_RECOVERY.
If the page is refreshed the PASSWORD_RECOVERY event is no longer emitted but the user is signed.
This means that the password reset link acted as a one time password.
I explored all the fields in the provided access token but I could not find any field that indicates that this token is only meant to be used for resetting the password.

[knielsen24]

I am having the same issue, but I am using client.auth.exchangeCodeForSession. Not ideal behavior for the email password login to have a "secret" OTP bypass.