Separating auth token for is_authorized

[dtrce]

I think it would be beneficial to make either is_authorized open or have flexibility to assign a separate token for the endpoint. This will make it easier to distribute auth keys without exposing the auth key for the endpoints for modifying policies or data.