use an incremental nonce + session token to prevent replay attacks