Inflating redirect response

Allows to call `authenticate` not only for Post but also for Redirect responses (typically, logout responses are redirect).
TODO: Redirect responses are not verified, it needs different code than for Post case.