make sure error message flashes work properly

flashes are consumed by the jinja template calling get_flashed_messages
in flash_messages.html.

When you call `abort(403)` the 403 error page is rendered, with the
flashed message on it. However, the webauthn endpoints just return that
page to the ajax `fetch`, which ignores the response and just reloads
the page.

Instead of calling abort, we can just return an empty response body and
the 403 error code, so that the flashed messages stay in the session and
will be rendered when the `GET /two-factor-webauthn` request happens
after the js reloads the page.

app/main/views/two_factor.py

@@ -86,6 +86,7 @@ def two_factor_sms():
 @main.route('/two-factor-webauthn', methods=['GET'])
 @redirect_to_sign_in
 def two_factor_webauthn():
+    # TODO: Return a sensible error page if the user isn't platform admin or doesn't have webauthn
     redirect_url = request.args.get('next')
     return render_template('views/two-factor-webauthn.html', redirect_url=redirect_url)