Would be safer to rely more on what the provider actually sent than the response type configuration

Some provider may not actually follow the indicated response type (would not be the worst thing I have seen providers not do as expected...).