internal provisioner api will be trusted when security is added,

should not be authenticating with an api key and provisioners
should be able to get any tenant resource they needed. Thus,
moving tenant id into the path.