check whether timestamp is not in the future + clarify replay attack-logic