clarify CS3a's usage of onetimeauth thanks to @fd, needs more docs yet but the key should be unique now with the nonce combined, fixes #68