Require nonces for cookie-based authentication

Fixes #177 by requiring the use of nonces on all pages accessed via WP's built-in cookie authentication.

For requests without nonces (e.g. users viewing the API directly in their browser), these will be treated as unauthenticated users. Requests with invalid nonces will cause an error, however.

Blocked on #152.