Sure, if you assume the session is scoped to allow registering a new passkey. Depends on how the application is configured. Regardless, getting the credential is different from getting a session.