determine auth strategy for microservice metadata requests

[zenlex]

Ultimately we plan to allow services to read/write their own user metadata. This means the API gateway will accept incoming POST requests to the /api/userdata endpoint. We should establish a token flow or other auth for services to authenticate these requests with the gateway.

• Research and architect best practice for microservice auth on backend requests to gateway (open source services, not all in our control per se other than registration)
• Implement auth flow
• Update SERVICES.md