The spec currently does not mention that returning accounts must be returned first in the API. This lets the IDP know that the first one is a returning account, since the method only returns something when the user is a returning user (eg there is at least one returning account)