Add note about fixed/empty user handles (#1483)

* Add note about fixed/empty user handles

See fido-alliance/fido-2-specs#951

* Reword

* Update index.bs

Co-authored-by: =JeffH <jdhodges@google.com>

Co-authored-by: =JeffH <jdhodges@google.com>

index.bs

@@ -2631,6 +2631,8 @@ credential.
         The [=user handle=] MUST NOT contain [PII] about the user, such as a username or e-mail address;
         see [[#sctn-user-handle-privacy]] for details.
 
+        Note: the [=user handle=] should not be a constant value across different accounts, even for [=non-discoverable credentials=], because some authenticators always create [=discoverable credentials=]. Thus a constant [=user handle=] would prevent a user from using such an authenticator with more than one account at the [=[RP]=]. Additionally,  a [=user handle=] having an empty value is known to be problematic in practice so is a bad choice, even if a constant value is desired.
+
     :   <dfn>displayName</dfn>
     ::  A [=human palatability|human-palatable=] name for the user account, intended only for display. For example, "Alex P. Müller" or "田中 倫". The
         [=[RP]=] SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.