When you aren't invalidating tokens your app server can serve all static but restricted content without checking with the DB.