Re-use sender's nonce and ts for response authZ
No longer assume a content-type if empty