note should we check for a nonce before mutual auth