rework app token authorization, update bulk poll api call

@voidfiles can you take a look at this and sign off?