update login protocol

The nonce needs to be created hub side because otherwise it's not proof of the user's identity.  I also think it makes more sense for the sessionID's to be created at the hub.