Passing auth header to permitAll path throws 401

Question

I have an API configured with Spring Security\'s permitAll():

class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void