title: How do you use security rules to prevent a user from faking Firebase.ServerValue.TIMESTAMP?
body: <p>My app requires a reliable timestamp value for the creation of new records. I'm using Firebase.ServerValue.TIMESTAMP to ensure this. Here's my code:</p>
  
  <pre><code>var ref = new Firebase("https://test-firebase-please-ignore.firebaseio.com/foo");
  ref.set(Firebase.ServerValue.TIMESTAMP);
  </code></pre>
  
  <p>or in REST:</p>
  
  <pre><code>$ curl -X PUT -d '{"foo":{".sv":"timestamp"}}' \
    https://test-firebase-please-ignore.firebaseio.com/.json 
  </code></pre>
  
  <p>How do I prevent an abusive user from crafting a request that looks valid, but is actually a fake timestamp in the past or future?  Here's code they might use:</p>
  
  <pre><code>var ref = new Firebase("https://test-firebase-please-ignore.firebaseio.com/foo);
  ref.set(1408643272324); //A timestamp in the past
  </code></pre>