Note: when the credentials carry Qop.AuthInt, the request entity body is read fully into memory to verify the digest