auth: randomize nonce for SCRAM-SHA1