The check for !_isInternalClient() is redundant because of the checks for authentication that we are doing. Internal clients will be authorized with as __system, which will always have the direct shard operations action type.