Enforce has nonce

[mathieu-lacage]

What

Return the nonce parameter from verify method (None is returned if it is not in the request).

Why

Because this allows the verifier caller to:

• check that the client HAS provided a nonce (a bit like covered_components can be used to verify the the client has included the necessary fields in the signature)
• track the list of nonces used by the client to be able to detect nonce reuse in the caller.

Alternative

I could also move the nonce reuse logic into the verifier and provide an enforce_has_nonce argument to the verify method but I decided against it because it would force the verifier to track long-running state (like the set of nonces used) or it would require the caller to give a handle to a function to check that a nonce has been used, both of which would increase the scope of the current API. Let me know if you prefer one of these options so I can rework the patch accordingly.

[mathieu-lacage]

PR for #26