SECOAUTH-400: ensure implicit response is encoded