Session nonce should be hash