[kedean]

I'd say at the very least, the heartbeat should be spawned asynchronously. As it is, someone DOS-ing your API could cause problems for every user.