Reject WebAuthn verify assertion bound to a different user (#1234)