I'm confused by that as well. The POST data sends a nonce value but the message itself is in plaintext... not even Base64..