Discover and fix webauthn-related security hole during testing. Now including a session ID with each request to prevent malicious users from mucking with other people's credentials #simpleotp