Challenge is expected in timestamp token in case 2

In the second case out of the two cases of authorization enforcement
described for update(), it seems like the challenge is expected in
the timestamp token.

Test: N/A
Change-Id: I33e1b84bf8218335665b31ca144b3b4ecb342328