Need to revise internal authorisation calls to inform cbauth the action is internal

When we have a suitable API from cbauth, we must use it to tell cbauth when an authorisation request is internally driven so that such actions can be excluded from auditing.  This is important to reduce redundant audit logging and improve utility of auditing.