Fix sessions#auth spec
Add app authorization for each request
[fix] Authorized apps environment variable type
Test
Remove client app authorization
Remove access to methods without providing a token