Go parallel later in makeCredential().

This fixes #263 and fixes half of #254.

index.bs

@@ -418,23 +418,14 @@ When this method is invoked, the user agent MUST execute the following algorithm
 
     Issue: Put some constraints on the "reasonable range".
 
-2. Let |promise| be [=a new promise=]. Return |promise| and start a timer for |adjustedTimeout| milliseconds.
-    Then execute the following steps [=in parallel=]. If any fatal error is encountered in this process other than the
-    ones enumerated below, cancel the timer, [=reject=] |promise| with a DOMException whose name is "{{UnknownError}}", and terminate
-    this algorithm.
-
-    Issue: Should "process" be "algorithm", or does it actually mean an OS
-    process? What kinds of fatal errors are you worried about? I suggest we just
-    remove that sentence.
-
 3. Set |callerOrigin| to the [=web/current settings object=]'s [=web/origin=]. If |callerOrigin| is
-    an [=web/opaque origin=], reject |promise| with a {{DOMException}} whose name is "{{NotAllowedError}}", and
+    an [=web/opaque origin=], return [=a promise rejected with=] a {{DOMException}} whose name is "{{NotAllowedError}}", and
     terminate this algorithm. Otherwise,
     - If the {{ScopedCredentialOptions/rpId}} member of {{options}} is not <a>present</a>, then set |rpId| to |callerOrigin|.
     - If the {{ScopedCredentialOptions/rpId}} member of {{options}} is <a>present</a>, then invoke the procedure used for
         <a>relaxing the same-origin restriction</a> by setting the `document.domain` attribute, using
         {{ScopedCredentialOptions/rpId}} as the given value but without changing the current document's `domain`. If no errors
-        are thrown, set |rpId| to the value of `host` as computed by this procedure. Otherwise, reject |promise| with a
+        are thrown, set |rpId| to the value of `host` as computed by this procedure. Otherwise, return [=a promise rejected with=] a
         <a>DOMException</a> whose name is "SecurityError", and terminate this algorithm.
 
     Issue(w3c/webauthn#259): The rest of this algorithm assumes |rpId| is an
@@ -455,8 +446,8 @@ When this method is invoked, the user agent MUST execute the following algorithm
         |algorithm| set to |normalizedAlgorithm|.
 
 6. If |normalizedAlgorithm| is empty and {{cryptoParameters}} was not empty,
-    cancel the timer started in step 2, [=reject=] |promise| with a
-    {{DOMException}} whose name is "{{NotSupportedError}}", and terminate this
+    cancel the timer started in step 2, return [=a promise rejected with=] with
+    a {{DOMException}} whose name is "{{NotSupportedError}}", and terminate this
     algorithm.
 
 7. Let |clientExtensions| be a new [=list=].
@@ -501,8 +492,7 @@ When this method is invoked, the user agent MUST execute the following algorithm
     [=present=] or its value matches |authenticator|'s attachment modality,
     [=set/append=] |authenticator| to |currentlyAvailableAuthenticators|.
 
-14. [=set/For each=] |authenticator| in |currentlyAvailableAuthenticators|, [=in
-    parallel=]:
+14. [=set/For each=] |authenticator| in |currentlyAvailableAuthenticators|:
     1. Let |excludeList| be a new [=list=].
     2. [=list/For each=] credential |C| in <code>{{options}}.{{ScopedCredentialOptions/excludeList}}</code>:
         1. If |C| has an empty {{transports}} list, [=list/append=] it to
@@ -512,12 +502,21 @@ When this method is invoked, the user agent MUST execute the following algorithm
 
             Issue: I'm not sure this captures the intent of the original wording.
         3. [=list/Append=] |C| to |excludeList|.
-    3. Invoke the <a>authenticatorMakeCredential</a> operation on that
-        authenticator with |rpId|, |clientDataHash|, {{accountInformation}},
-        |normalizedParameters|, |excludeList| and |clientExtensions| as
-        parameters.
+    3. [=In parallel=], invoke the <a>authenticatorMakeCredential</a> operation
+        on |authenticator| with |rpId|, |clientDataHash|,
+        {{accountInformation}}, |normalizedParameters|, |excludeList| and
+        |clientExtensions| as parameters.
     4. [=set/Append=] |authenticator| to |issuedRequests|.
 
+2. Let |promise| be [=a new promise=]. Return |promise| and start a timer for |adjustedTimeout| milliseconds.
+    Then execute the following steps [=in parallel=]. If any fatal error is encountered in this process other than the
+    ones enumerated below, cancel the timer, [=reject=] |promise| with a DOMException whose name is "{{UnknownError}}", and terminate
+    this algorithm.
+
+    Issue: Should "process" be "algorithm", or does it actually mean an OS
+    process? What kinds of fatal errors are you worried about? I suggest we just
+    remove that sentence.
+
 11. While |issuedRequests| is not empty, perform the following actions depending upon the |adjustedTimeout| timer and responses
     from the authenticators:
     <dl class="switch">