quick partial comment regarding:


>    As for "invalid nonce .* received - hash is not..." this seems to be the
>    basic denial of the digest auth being the equivalent of "wrong password".
>    It doesn't report as this because the username, relm and password are
>    hashed together by the digest algorithm. I'm hoping, because you have them
>    in your logs, you can see the cause of them a little more to see whether
>    they are accidental password entry or a very expired nonce. I don't want
>    to be too quick to right this off as benign.

in my case it is due to zotero checking if DB was updated on webdav:  those
"hash is not" coming for me pretty much on a daily basis (some times few times
a day if IP changes -- home-vs-work)

 access.log
    10.31.209.217 - XXX [15/May/2013:21:39:09 -0400] "GET /XXX/zotero/lastsync.txt HTTP/1.1" 401 486 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130505 Firefox/17.0 Iceweasel/17.0.5"
    10.31.209.217 - XXX [15/May/2013:21:39:09 -0400] "GET /XXX/zotero/lastsync.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130505 Firefox/17.0 Iceweasel/17.0.5"
 error.log
    [Wed May 15 21:39:09 2013] [error] [client 10.31.209.217] Digest: invalid nonce 0WCBvsbcBAA=74599a088b6d334cfd7041012bac139971038ac4 received - hash is not c16b8de9cb68361488598820648f09859eb93f97

the exact order is not clear here, so from
http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
I thought "If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials" is in place and 401 above is due to nonce expired, so it is more of :

http://httpd.apache.org/docs/current/mod/mod_auth_digest.html
"When the client contacts the server using an expired nonce the server will send back a 401 with stale=true"

.but unless it was a flip of a second another random log suggests that nonce
invalid follows 401 not preceeds:

    10.31.23.99 - XXX [11/Oct/2012:13:26:06 -0400] "OPTIONS /XXX/zotero/ HTTP/1.1" 401 486 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:10.0.6) Gecko/20100101 Firefox/10.0.6 Iceweasel/10.0.6"
    10.31.23.99 - XXX [11/Oct/2012:13:26:07 -0400] "OPTIONS /XXX/zotero/ HTTP/1.1" 200 - "-" "Mozilla/5.0 (X11; Linux x86_64; rv:10.0.6) Gecko/20100101 Firefox/10.0.6 Iceweasel/10.0.6"
    [Thu Oct 11 13:26:07 2012] [error] [client 10.31.23.99] Digest: invalid nonce +YSJsLnLBAA=48b011eb5f745fd3154ef15e7249937bad4d1ea3 received - hash is not c9d8019c10538009292746080978ee59a9d8d45e

... anyways -- I have enabled zotero debugging and would provide more
information whenever new msg of a kind gets logged (last one was Sun Jul
07 15:25:54 2013)

-- 
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate,     Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik