The answer to all 3 questions is yes .
You need to place the tracking code on every page you want to crawl . Even the page having authentication, analytics can "see" the relevant data, and provide the features we want, such as number of accesses, dwell time, rejection rate etc ... and the most important imo, which is behavior flow .
The location indicated by google to place the tracking code is among the head
tags, as in the example below:
<head>
<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-XXXXX-Y', 'auto');
ga('send', 'pageview');
</script>
</head>
See the help page on developers .
As indicated by @Ricardo Gaya, in the answer above, it is also possible (and indicated) to use a tag manager, such as Google's own , to make the upload asynchronous.