Expired access token results in a 401 on a public resource

To reproduce: Make an authenticated request (with an expired bearer token) to a public resource.

Since authentication and token validation happens before access control, the authentication layer throws a 401 unauthorized / invalid token.
But there may be developer expectation that a public resource should not even check or validate authentication, so this 401 may be unexpected.

未指定檔案、測試或進入點。使用已過期的 bearer token 重現該請求，然後釐清公開資源應繞過 token 驗證，還是仍然回傳 401；完成此項工作需要就行為達成共識並驗證該行為。