Auth fixes

Allow auth to be flexible enough to check route/methods in addition to key/client pair