The Digest uri and A2 took the raw path, while the request line carried it encoded, with the params and without the fragment, so a server comparing the two rejected the credentials. Build the target in one place for both.