Add support for operations that use multiple forms of auth

[erunion]

We support operations that use a single form of auth like apiKey or an auth header, but what if they use both? How can we know that a key used in api.auth() goes to a query param, and another is for a header?

[erunion]

There's an open ticket for this in #701