## What kind of change does this PR introduce?

Currently, create server client doesn't seem to set cookies when MFA
Challenge is verified

## What kind of change does this PR introduce?

As per title

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

When resetting a user's password with an email template which has a URL
defining the `type` value as `recovery`, and using the `verifyOtp`
method to process the token_hash and type, the SSR server client's
`onAuthStateChange` function does not recognize the `PASSWORD_RECOVERY`
event that verifyOtp fires. This prevents the code
[here](https://github.com/supabase/ssr/blob/main/src/createServerClient.ts#L199-L205)
from running; resulting in the new session not being saved to cookies,
and the user is not considered logged in.

Fixes #21

## What is the new behavior?

User is logged in.

## Additional context

Replaces PR #24

Co-authored-by: Jason Creviston <[email protected]>

## What kind of change does this PR introduce?

so that we can unblock v0.4.1. Referencing the Auth workflow:
https://github.com/supabase/auth/blob/master/.github/workflows/test.yml