Generating a true random nonce during authentication is costly.
The cause of this regression is the requirement to introduce a
well supported and reasonably NDRG.
However, random numbers won't make any difference for 
functionality of the server nonce as we might as well have been
using a deterministic sequence.
The solution is to revert back to the previous random string
implementation.