Does it make sense here to recreate the flow based on the Via headers and authenticate it?  We have enough information here to do so, but we'd need to be careful not clash with another inbound request on the same UDP quad.