Can we use `wp_nonce_field()` here instead? That should also let us remove the `wp_create_nonce()` calls on the lines above, I think.