ehm...

you just let everything through regardless of the token or whether you are logged in or not.

callbacks: {
        async authorized() {
            return true; // Allow all requests to pass through
        },
    },