Now the client can opt out of receiving the whole JSON body if it hasn't changed since they last requested.
Right now, only `ETag` and `If-None-Match` headers are implemeted which isn't very RFC-spec compliant but it's all I need so I don't care.
Creates the transaction record and updates the merchandise quantity in one db transaction.
Managed to do the merchandise update in one UPDATE query, but the error that's thrown when an item to buy is not found is pretty confusing, so I convert it to a 404.
I also added some DB indexes.
