But how else would you detect a session timeout when `Client#authenticated?` does only check the presence of the token in the request headers hash?