Validate client nonces and application URIs

…but then comment out validating the provided URI against the URI on
the certificate because the CTT certificates all contain invalid URIs
right now.