InResponseTo in response can be empty, then don't validate the request state