salt the nonce for extra anti-csrf goodness