Return error if nonce doesn't match
Return error if nonce doesn't match

An invalid nonce should never reach the identity_url checking code, which
allows a user to login.
diso/wordpress-openid,diso/wordpress-openid