add 3scale authorization and reporting + api paths
clean up auth logic