CTRAPS: CTAP client impersonation and API confusion on FIDO2