use a better oauth nonce