Always verify UP bit in RP ops

As pointed out by @akshayku, recent drafts of CTAP now support this.

index.bs

@@ -2880,12 +2880,11 @@ When registering a new credential, represented by an {{AuthenticatorAttestationR
 
 1. Verify that the [=RP ID=] hash in |authData| is indeed the SHA-256 hash of the [=RP ID=] expected by the RP.
 
+1. Verify that the [=User Present=] bit of the <code>[=flags=]</code> in |authData| is set.
+
 1. If [=user verification=] is required for this registration, verify that the [=User Verified=] bit of the <code>[=flags=]</code>
     in |authData| is set.
 
-1. If the [=User Verified=] bit of the <code>[=flags=]</code> in |authData| is not set, verify that the [=User Present=] bit of
-    the <code>[=flags=]</code> in |authData| is set.
-
 1. Verify that the values of the [=client extension outputs=] in |clientExtensionResults| and the [=authenticator extension
     outputs=] in the <code>[=authdataextensions|extensions=]</code> in |authData| are as expected, considering the [=client
     extension input=] values that were given as the {{PublicKeyCredentialCreationOptions/extensions}} option in the
@@ -2991,12 +2990,11 @@ When verifying a given {{PublicKeyCredential}} structure (|credential|) and an {
 
 1. Verify that the <code>[=rpIdHash=]</code> in |aData| is the SHA-256 hash of the [=RP ID=] expected by the [=[RP]=].
 
+1. Verify that the [=User Present=] bit of the <code>[=flags=]</code> in |authData| is set.
+
 1. If [=user verification=] is required for this assertion, verify that the [=User Verified=] bit of the <code>[=flags=]</code> in
     |aData| is set.
 
-1. If the [=User Verified=] bit of the <code>[=flags=]</code> in |authData| is not set, verify that the [=User Present=] bit of
-    the <code>[=flags=]</code> in |authData| is set.
-
 1. Verify that the values of the [=client extension outputs=] in |clientExtensionResults| and the [=authenticator extension
     outputs=] in the <code>[=authdataextensions|extensions=]</code> in |authData| are as expected, considering the [=client
     extension input=] values that were given as the {{PublicKeyCredentialRequestOptions/extensions}} option in the