core: Private boxes authenticate metadata box URLs too