Remove redundant restrictions for WebAuthn feature

Since the register and authentication APIs work in pairs, we can
just put the restrictions on the "begin" API. We weren't testing
the restrictions on the "complete" API anyway.

For authentication, it's also enough to check if the user has
WebAuthn as their auth type, as it's not a big deal if a user
continues to login with a security key indefinitely.

app/main/views/webauthn_credentials.py

@@ -38,7 +38,6 @@ def webauthn_begin_register():
 
 
 @main.route('/webauthn/register', methods=['POST'])
-@user_is_platform_admin
 def webauthn_complete_register():
     if 'webauthn_registration_state' not in session:
         return cbor.encode("No registration in progress"), 400
@@ -81,9 +80,6 @@ def webauthn_begin_authentication():
     if not user_to_login.webauthn_auth:
         abort(403)
 
-    if not user_to_login.platform_admin:
-        abort(403)
-
     authentication_data, state = current_app.webauthn_server.authenticate_begin(
         credentials=user_to_login.webauthn_credentials.as_cbor,
         user_verification="discouraged",  # don't ask for PIN
@@ -105,12 +101,6 @@ def webauthn_complete_authentication():
     user_id = session['user_details']['id']
     user_to_login = User.from_id(user_id)
 
-    if not user_to_login.webauthn_auth:
-        abort(403)
-
-    if not user_to_login.platform_admin:
-        abort(403)
-
     try:
         _verify_webauthn_authentication(user_to_login)
         redirect = _complete_webauthn_login_attempt(user_to_login)