generateNonce is not cryptographically secure since it relies on Math.random, which is not sufficiently random. We should be using crypto.randomBytes. Or better yet, we should implement our own cross-platform method that uses all the best randomization on node, the browser (with special cases for every browser), and WinJS.