"Further note that if the client does not need to encrypt parameters or other information on the GET request, then the message exchanges between the server and TTP are not strictly required." . . . .