Change endpoint nonce calculation

- never use future time, that's dumb
- allow previous two to be valid
- use logged out uid and token
- name the action

This more closely emulates how the WP nonce works.