make nonce in internal urls configurable
fix typo; add missing initialization