Issue 1: We are aware of this issue and will be fixing it soon. We'll get back when we have an ETA.
Issue 2: For developer portal authentication, the forced login authentication is configured in the backend, so that all API consumers are forced to sign up and then login to portal. Since there's no need to configure it in the UI, we're thinking to hide this page.
Issue 3: Since the Virtual host (Gateway URL) and the Developer portal URL are pre-configured as part of the API management provisioning process, using the "Subdomain" information, this setting should not have any adverse effect, and we can hide it in future.
Issue 4: It is by design, we have hidden the Organization settings. Sharding tags are not required to be created based on the way the API management gateway is configured. Is there any other use case for which you need access to Organization settings?