use http transport, ignore initial (null) firebase responses, add logging
use signedVerhash for both from= and to= in server messages, not just to=