perform MAC check on server response without feeding the response into the browser