update RWO algo to support additional origins with the same label

Author: timcappalli

index.bs

@@ -4130,9 +4130,10 @@ To validate the calling origin is an authorized related origin for a given cerem
     1. Let |domain| be the [=effective domain=] of |url|. If that is null, [=continue=].
     1. Remove any [=public suffix=] from the end of |domain|, including private registries and unknown registries. If |domain| is now empty, [=continue=].
     1. Split |domain| into |labels| and let |label| be the right-most one.
+    1. If the [=set/size=] of |labelsSeen| is greater than or equal to |maxLabels| and |labelsSeen|does not [=contains|contain=] |label|, [=continue=].
     1. If |callerOrigin| and |url| are [=same origin=], return [TRUE].
-    1. [=set/Append=] |label| to |labelsSeen|.
-    1. If the [=set/size=] of |labelsSeen| is greater than or equal to |maxLabels|, [=break=].
+    1. If |labelsSeen| [=contains=] |label|, [=continue=].
+    1. If the [=set/size=] of |labelsSeen| is less than |maxLabels|, [=set/Append=] |label| to |labelsSeen|.
 1. Return [FALSE].
 
 # WebAuthn <dfn>Authenticator Model</dfn> # {#sctn-authenticator-model}