fix #1845
view.New
There is no need to do extra work like creating a session and its associated view until the user has been properly identified and as many possibly-failing sql request have been successfully run.
This is a rebase of #1618 in which @dave-atx added WebAuthn support. Closes #1618
For reference: https://go.dev/doc/go1.4#internalpackages
