implements transaction boundaries

* sends 403 if requirement is not met
* tests
0.17.0