So. I just tried out my recovery flow and after entering the code - I am thrown into a redirect loop... This must be something with oathkeeper, as it thinks creds are invalid. I think it may be here?

id: "ory:kratos-selfservice-ui-node:protected"
  upstream:
    preserve_host: false
    url: "IP_REMOVED"
  match:
    url: "<http://HOSTNAME/><{,dashboard,settings,consent}>"
    methods:
      - GET
      - POST
  authenticators:
    - handler: cookie_session
  authorizer:
    handler: allow
  mutators:
    - handler: id_token
  errors:
    - handler: redirect
      config:
        to: <http://HOSTNAME/login>