Expired access token results in a 401 on a public resource

To reproduce: Make an authenticated request (with an expired bearer token) to a public resource.

Since authentication and token validation happens before access control, the authentication layer throws a 401 unauthorized / invalid token.
But there may be developer expectation that a public resource should not even check or validate authentication, so this 401 may be unexpected.

未指定文件、测试或入口点。使用已过期的 bearer token 重现该请求，然后明确公共资源应绕过 token 验证，还是仍然返回 401；完成此项工作需要就行为达成一致并验证该行为。