Switch to sending 403's on session expiry.
Also change to a function ref in heartbeat.