fix: remove hardcoded credentials from source code

- Move PayPal live/sandbox API keys to env variables
- Move hardcoded API token in isAuthorized middleware to env variable
- Add api_token key to config/app.php
- Update .env.example with new required env vars
- Fix isAuthorized response code from 503 to 401

config/app.php

@@ -80,6 +80,8 @@ return [
 
 	'key' => env('APP_KEY', 'SomeRandomString'),
 
+	'api_token' => env('API_TOKEN'),
+
 	'cipher' => MCRYPT_RIJNDAEL_128,
 
 	/*