Now the server has to store the password in plain text so it can rehash with the new nonce every time.