Rewrite counter check to conform with specification

[TobiasBengtsson]

The WebAuthn specification mandates that the counter check should be performed if either of the counters are non-zero.

[lbuchs]

Thanks!