validate nonce