Only send expiry time in reauth assertions
Use defined protocol minor status codes on wire