Client-cert authorization between internal web services