public static function verifyNonce($id, $cnonce)
    {
        $ns = new SessionNamespace($id);
        $nonce = $ns->nonce;

        // validate token
        if (empty($cnonce) || $cnonce !== $nonce) {
            return false;
        }

        // validate referrer
        $referrer = Url::getReferrer();
        if (!empty($referrer) && !Url::isLocalUrl($referrer)) {
            return false;
        }

        // validate origin
        $origin = self::getOrigin();
        if (!empty($origin) &&
            ($origin == 'null'
                || !in_array($origin, self::getAcceptableOrigins()))
        ) {
            return false;
        }

        return true;
    }