nonce is not predictable (CWE-330).
Divide the software into anonymous, normal, privileged, and administrative areas.
Reduce the attack surface by carefully defining distinct user groups, privileges, and/
or roles. Map these against data, functionality, and the related resources. Then set the