for authorization feature.
1.client nonce is used for pwd
2.server querey db by nonce & username