change scope of new_resource in api_stash provider

this:
a) is more correct and consistent
b) addresses FCO17 false positives