if principal is not authorized to impersonate, return 403
add status check to heartbeat. by default this is a nop and individual principals are responsible for implementing a status check.
we want to perserve the prototype of the principal, so just update attributes