Separate public and private invoice route

Better matches how apps are supposed to communicate on a local network
instead of over a public network where the api_key can be stolen.