If a request to the REST API contains an expired or a wrong session id, the request is handled as if the user were anonymous. As a result, the REST client has no mean to detect that the session is using has expired.

To me the correct behaviour would be to send a 4xx error.