- nonce is not well generated, nor is it validated in the request.
  This *NEEDS* to be fixed.
- Password must be entered in the same case as it is stored in the user
  database.  I *think* this is always uppercase, but I'm not sure.