Bah. Request's Hawk feature doesn't verify incoming responses so we shouldn't use it. I raised a bug https://github.com/mikeal/request/issues/807