Only allow internal requests