This doesn't match the following code - we seem to have removed the code that looks in the To URI.  Is this correct?  Will we always have an Authorization header?  (I think the commented-out code was an evolution of the original code which only looked in the To URI.)