Remove user handle MAY be null

As far as we can tell, the statement "...MAY be null" clause of the statement:
> [...] The user handle MUST NOT be empty, though it MAY be null.

..is incorrect and ought to be removed.

cf. https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dom-publickeycredentialuserentity-id

fixes #1598

index.bs

@@ -2638,7 +2638,7 @@ credential.
         {{PublicKeyCredentialUserEntity/displayName}} nor {{PublicKeyCredentialEntity/name}} members. See Section 6.1 of [[!RFC8266]].
 
         The [=user handle=] MUST NOT contain [PII] about the user, such as a username or e-mail address;
-        see [[#sctn-user-handle-privacy]] for details. The [=user handle=] MUST NOT be empty, though it MAY be null.
+        see [[#sctn-user-handle-privacy]] for details. The [=user handle=] MUST NOT be empty.
 
         Note: the [=user handle=] <i>ought not</i> be a constant value across different accounts, even for [=non-discoverable credentials=], because some authenticators always create [=discoverable credentials=]. Thus a constant [=user handle=] would prevent a user from using such an authenticator with more than one account at the [=[RP]=].