Server should check the nonce - see http://en.wikipedia.org/wiki/Digest_access_authentication#Advantages