replaced session code to wp nonces