Always send Message-Authenticator for proxied Access-Requests

It's 2013.  There's no reason avoid security