Use internal_auth for cross-service communication

At least in one case the access over public was flakey,
and we shouldn't do this in the first place.