check nonce in redirects