Allow authorization read, and delete/retrieve by both token and id.  Broker key auth uses a special scope.