Storyline 3.18.28642.0 publishing breaks tincan tracking -- forbidden

I was told to get this new version because of these threads: https://community.articulate.com/discussions/articulate-storyline/firefox-is-it-compatible-or-not

SL360 content running in latest Firefox browser shows several JavaScript errors and not in other browsers - Articulate Storyline Discussions - E-Learning Heroes

Now when I publish for tincan, my tracking doesn't work.  Going through fiddler I see that my tincan tracking statements are getting 403 forbidden errors, so my tracking methods are not getting called.  Using published files from my older version - 3.15.26826.0 -- works fine.  They return 204, my methods get called and all is good.  What changed? 

A couple of notes:

• The tincan.xml files produced by each version are identical
• I notice that when publishing in the new version, the dropdown says xAPI instead of tincan.  Does this mean there are other differences?

Thanks