Actually, this does look more like an urllib2 bug.
According to RFC 2617, the nonce count should represent the number of
requests sent with a particular nonce. But we don't reset the nonce
count when we start using a new nonce. That discrepancy in nonce counts
causes LJ to reject the connection.

Why does it fail the third time, rather than the second? See the LJ code
from http://code.sixapart.com/svn/livejournal/trunk/cgi-bin/ljlib.pl
(which I *think* applies here, but could easily be wrong):
    # check the nonce count
    # be lenient, allowing for error of magnitude 1