Only use auth_nonce for reauthentication (closes #566)