engine requests must have verified ssl client cert

base.py

@@ -57,7 +57,11 @@ class RequestHandler(webapp2.RequestHandler):
                     self.abort(402, remote_instance + ' is not an authorized drone')
                 self.drone_request = True
         self.public_request = not bool(self.uid)
-        if self.public_request or self.source_site:
+        log.debug('public request: %s' % str(self.public_request))
+        if engine_request:
+            self.superuser_request = True
+            self.public_request = False
+        elif self.public_request or self.source_site:
             self.superuser_request = False
         else:
             user = self.app.db.users.find_one({'_id': self.uid}, ['root', 'wheel'])