Don't include display addresses in To fields
Add small sanity check about who sent the reply
Switch to a case-insensitive reply info verifier
Look at bytes, not chars, in secure_equals
More clear ReplyInfoVerifier case-insensitive test