wrt PR #397 and #398

I have a few comments on  PR#397<https://github.com/w3c/webauthn/pull/397> that i'd prefer addressed prior to merging (am nominally fine with merging it).

I'm fine with merging the first two commits of PR#398 per https://github.com/w3c/webauthn/pull/398#issuecomment-294038181

will get to PR#399 in the morning...

HTH,
=JeffH