require transfer requests to be fresh and signed by both parties
Implement freshness assertion generation on the server side. Closes #11.