Biometric re-authentication

Let returning users prove it is them with a selfie.

For logins, payouts or account changes, ask for a selfie and liveness only, and compare it with the user's last approved selfie.

curl -X POST https://{{HOST}}/v3/session/ -H "x-api-key: sk_test_..." -H "Content-Type: application/json" \
  -d '{"type":"authentication","vendor_data":"user-1","callback":"https://yourapp.com/done","flash_check":true}'

The result is in decision.biometric_authentications[]. The user must have an approved session first.