added nonce check on settings pages to protect from CSRF - props @harrym