Express app is returning 403 errors unless twilio.webhook() has validate set to false

heroku-bash-output

twilio-api on master
$ heroku run bash
Running `bash` attached to terminal... up, run.9605
Detected 512 MB available memory, 512 MB limit per process (WEB_MEMORY)
Recommending WEB_CONCURRENCY=1
~ $ echo $TWILIO_AUTH_TOKEN
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
~ $ node
> console.log(process.env.TWILIO_AUTH_TOKEN)
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
undefined 

index.js

var express = require('express');
var bodyParser = require('body-parser');
var twilio = require('twilio');

var app = express();
app.set('port', (process.env.PORT || 5000));
app.use(express.static(__dirname + '/public'));
app.use(bodyParser.urlencoded({ extended: true }));

app.get('/', function(request, response) {
  response.send('Hello World!');
});

app.post('/sms', twilio.webhook({validate: false}), function(request, response) {
  var twiml = new twilio.TwimlResponse();
  twiml.message('Hello World!');
  response.send(twiml);
});

app.listen(app.get('port'), function() {
  console.log("Node app is running at localhost:" + app.get('port'));
});