create webauthn 2fa page

if user has `webauthn_auth` as their auth type, then redirect them to an
interstitial that prompts them to click on a button which right now just
logs to the JS console, but in a future commit will open up the webauthn
browser prompt

content is unsurprisingly not final.

tests/app/main/views/test_sign_in.py

@@ -160,6 +160,34 @@ def test_process_email_auth_sign_in_return_2fa_template(
     mock_verify_password.assert_called_with(api_user_active_email_auth['id'], 'val1dPassw0rd!')
 
 
+@pytest.mark.parametrize('redirect_url', [
+    None,
+    f'/services/{SERVICE_ONE_ID}/templates',
+])
+def test_process_webauthn_auth_sign_in_redirects_to_webauthn_with_next_redirect(
+    client,
+    api_user_active,
+    mocker,
+    mock_verify_password,
+    redirect_url
+):
+    api_user_active['auth_type'] = 'webauthn_auth'
+    mock_get_user_by_email = mocker.patch('app.user_api_client.get_user_by_email', return_value=api_user_active)
+
+    response = client.post(
+        url_for(
+            'main.sign_in', next=redirect_url
+        ),
+        data={
+            'email_address': 'valid@example.gov.uk',
+            'password': 'val1dPassw0rd!'
+        }
+    )
+    mock_get_user_by_email.assert_called_once_with('valid@example.gov.uk')
+    assert response.status_code == 302
+    assert response.location == url_for('.two_factor_webauthn', _external=True, next=redirect_url)
+
+
 def test_should_return_locked_out_true_when_user_is_locked(
     client,
     mock_get_user_by_email_locked,

tests/app/main/views/test_two_factor.py

@@ -258,15 +258,25 @@ def test_two_factor_returns_error_when_user_is_locked(
     assert 'Code not found' in response.get_data(as_text=True)
 
 
-def test_two_factor_should_redirect_to_sign_in_if_user_not_in_session(
-    client,
-    api_user_active,
-    mock_get_user,
+def test_two_factor_post_should_redirect_to_sign_in_if_user_not_in_session(
+    client_request,
 ):
-    response = client.post(url_for('main.two_factor'),
-                           data={'sms_code': '12345'})
-    assert response.status_code == 302
-    assert response.location == url_for('main.sign_in', _external=True)
+    client_request.post(
+        'main.two_factor',
+        _data={'sms_code': '12345'},
+        _expected_redirect=url_for('main.sign_in', _external=True)
+    )
+
+
+@pytest.mark.parametrize('endpoint', ['main.two_factor_webauthn', 'main.two_factor'])
+def test_two_factor_get_should_redirect_to_sign_in_if_user_not_in_session(
+    client_request,
+    endpoint,
+):
+    client_request.get(
+        endpoint,
+        _expected_redirect=url_for('main.sign_in', _external=True)
+    )
 
 
 @freeze_time('2020-01-27T12:00:00')