Possible bug - sign in after registration + require verified address for login

[stephentuso]

This seems like it could be the wrong behavior - when "sign in after registration" and "require verified address for login" are enabled, the session becomes active before verification is completed during the registration flow.

e.g. after registration, the verification form appears. At this point I wouldn't expect the session to be active, but navigating back to the app without completing the verification results in a valid session. The sign in flow does work as expected and the session isn't started until after verification.

Of course I can handle blocking access without verification on the application side, but it would be nice if that could be completely handled by Ory

[aeneasr]

To enable this, you will need to disable sign in after registration for now. It is currently not possible to require verification and then issue the session conditionally afterwards. We will need to clarify this in the console UI.