iOS-only: Triggering Face ID from JavaScript to lock down the /checkout route in a WebView app