The authorisation logic (as distinct from the authentication logic) has been changed to return a 419 Authentication Expired when the authentication token has expired. Previously, a 400 was returned, but now the 419 is used for expirations.