Yeah, this is an issue that could come up in a number of places but we could make it clear that it's public internal API with documentation.  
It seems like we'd have to do something more fancy/less comprehensible in order to expose this across classes but without being public. I think Brandon had some auth methods that were public internal API - maybe has some other ideas?