@1aurabrown => add some API routes

Removed the Authenticated API Provider as that's not the right route to go. 
Added stubbed data ( which I triple check ed for leakage, tokens and keys and my card details are fakes ) 

@AshFurrow - I standardised on _not_ having the `.` before the case statements. Pretty sure that was the outcome of our discussion before.
Not sure I love the idea of URL encoding at this step in the process, but I don't see an alternative. Going to open an issue on Moya for better solution that I'll get to eventually.