Fixing nonce security token usage to not generate a new token for both oauth and password signin