add nonce validation to 2f client; fixed bug in requesting a nonce