Can you explain a bit about what does the 'in-band' and 'out-of-bank' refer to?
From my view of the web page, the SOAP response only contains the '__REQUESTDIGEST' value, which shows in the POST content I caught using firebug.
Also, the other form parameters seem not changed, by comparing what was extracted from page source, with those caught from the POST content in firebug.