at least the last two -- could not they occur in regular, non-malicious usage scenarios?  we better not ban if someone/connection was just "slow"... I have no clue in "nonce"s, so I can be wrong here with my worry