My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forg