This should be using `Response#authorization` rather than digging around in params. The goal is that the `Response#authorization` is an opaque string value that can be used to reference the transaction in any future requests.