When we create an iterator we don't actually know that we have a live config
object and we must instead only rely on the header. We fixed it to use this in a
previous commit, but this makes it harder to misuse by converting to use the
header object in the typecast.

We also guard inside the `config_refresh` function against being given a
snapshot (although callers right now do check).