Adding check for HMAC during response verification

When a response is received, the challenge source should ensure
that this response is for a challenge it generated. This is done
by generating the HMAC for the challenge body included in the
response packet and comparing it against the HMAC included in
the response.