Verify email address operation should not log in the user

[SOHELAHMED7]

Verify email address operation should not log in the user

[bizley]

I would remove the login() step it. It will not affect existing apps and new projects will be safer after the change.

[SOHELAHMED7]

There is no problem in existing way. I would say better way is to not automatically log in the user. User can login only if password is provided (login form). Most of the web apps does not automatically log in the user. It just verifies the email address.

[machour]

I think this really boils down to a personal preference. I'd leave the template as it is and as it have been functioning for years.

[mtangoo]

But it is a template that someone is supposed to adopt to his own need. One will want auto login and another not wanting it, can remove. Can you explain why is it a problem?

I think adding documentation should be enough as we cannot cater every possible use case

[mtangoo]

I will remove it and document it for those who want to login automatically. What do you think @yiisoft/core-developers

[mtangoo]

@bizley @rhertogh

[mtangoo]

I think this really boils down to a personal preference. I'd leave the template as it is

In this case we should put a note to the documentation on the default behavior of the verify so that one cannot be surprised by the current behaviour (Especially new comers).

What do you think of that?

[mtangoo]

Let us continue discussion if any on #557