fix #700

Finally found a test to reproduce #700. Patched 'hapi-auth-hawk' to account for the missing body. If this works in prod I'll send a PR upstream.