use cryptographically secure prng for nonces

generateNonce uses mt_rand and shuffle, both of which are seeded only by the timestamp and pid
If you can guess someone's nonce you can spam requests to ajax.php and get logged in as them the next time they try to sign on