getNonce(), verifyNonce()

• use Zend_Session_Namespace() to store session-dependent nonce, and use its built-in capabaility to expire entries
• a criticism of some implementations is the reliance on a predictable input to the hash function (e.g., time() or non-private constants, e.g., user name) and/or low entropy (e.g., a single pseudo-random number generated value)
• a more robust defense should incorporate referrer checking