If the user retry to login, it will be accepted without the second factor. This patch force the session to be cleared and reloaded with the default values

Add the "authenticatorSelection" parameter to the registration_dict while adding a new security key.
This option has to be set to allow the use a the security key without
entering a PIN. The webauthn standard set the user verification to
"preferred"; Windows update 1903 force the creation of a PIN in this
case.

If a security key is configured, use it, otherwise use the TOTP field.

To be consistent with the reste of the project

Only get the last used security key to validate new users

The new api need the .hash() or .verify() to be clear regarding the specific operation done