WIP bump API to v18

- Use strict_encode64 to suppress whitespace from Authz header
- expose _purchase to allow undecorated Transactions

Nothing else has been updated.