nonce should always be treated as string