Add nonce to prevent replay attack

[mikesparr]

Ideally this is handled at API gateway layer but may consider adding nonce and check.