fixed checkout to record correct firebase properties; add basic (wrong!) firebase rules