successfully able to authorize then get an access token, set up security rules using the access token, and proxy request to source server, authorizing with the origin using the Authorization header.