Race the signed request based on issued_at

``` php
if (isset($_POST['signed_request'])) {
$this->setSignedRequest($_POST['signed_request']);
} else if (isset($_SESSION['gajus']['fuss'][$this->getId()]['signed_request'])) {
$this->setSignedRequest($_SESSION['gajus']['fuss'][$this->getId()]['signed_request']);
} else if (isset($_COOKIE['fbsr_' . $this->getId()])) {
$this->setSignedRequest($_COOKIE['fbsr_' . $this->getId()]);
}
```

It is incorrect to assume that `$_SESSION['gajus']['fuss'][$this->getId()]['signed_request']` will have the newest `signed_request` data. When used with [Fuss.js](https://github.com/gajus/fuss.js), `$_COOKIE` will always be fresher. Furthermore, `access_token` must be cached and included in the race condition.

The issue identifies the signed-request selection snippet as the entry point; start there and trace the POST, session, and cookie values used with Fuss.js. Done means freshness is determined by issued_at, with access_token included in the race and caching behavior verified by relevant project tests.

Written by the indexing model from the issue text.