Have `CreateRequest()` return a `*Request`

[cjpatton]

At the moment this function returns the serialized request and, separately, the nonce used to verify the response. One way to clean up this API is to return a *Request that the caller serializes itself before sending to the server.

Originally posted by @lukevalenta in #59 (comment)