Properly validate nonce in OA authentication