nonce, gcs, and wordpress auth