only supply nonce when a password digest is used to avoid schema validation errors