Changed nonce derivation to add random data as suffix.

Previously the random data was XOR'd with nonce, but based on
discussions on curves@moderncrypto.org I realized it's more robust
to include the random data into the hashing.

https://moderncrypto.org/mail-archive/curves/2014/000254.html