restrict nonce to be of length at most 32

[mraszyk]

This MR restrict the maximum length of a nonce in a request to 32 since 32 bytes are supposed to provide enough randomness.