No need to sanitise $challenge in `getassertion`

I now sanitise the challenge in getAssertion() instead.