fix: tolerate a response without its request in the size preflight

A caller-supplied transport may return a Response with Request unset (net/http itself guards for it), and reading the final request's Authorization header then panicked the whole sync. The answer is still used; authentication is not claimed when its provenance is unknown.