How to whitelist expired JWT token (@PermitAll does nothing)

Question

I am experimenting with Quarkus+SmallRye JWT and Cookie tokens. I wish to note, that JWT token architecture is very poor. Tokens are self contained and are treated valid or inva