fix(webauthn): include backup flag check in registration (#748)