where to put "WSGIPassAuthorization On"?

It depends on your Apache configuration as different Apache installations have different layouts. In general, since the affect of the directive can be isolated to a specific context, such as a specific virtual host (VirtualHost), specific set of URLs (Location), or specific scripts (Directory/Files), you put it with whatever is the smallest context you need it. That way you don't end up passing the information to applications that do not need it. At the worst, stick it next to the WSGIScriptAlias directive, which would mean it is constrained to the virtual host.