Allow in-cluster traffic through ambassador while enable basic username/password login with ambassador

[kunmingg]

See #2094 for longer story.
Need to allow in cluster traffic while enable basic auth.

By current design, basic auth accept username/password or cookie, but in-cluster traffic would have none of them.

Auth server should recognize in-cluster traffic and allow them.
This should be transparent to individual components.

[kunmingg]

One easy solution is to have separate ambassador services:

1. external facing:

• used by user request, from browser or API call
• every request validate by auth service

2. internal facing:

• used by in-cluster traffic.
• only accessible within cluster
• doesn't go through auth service