Avoid unsupported and unintended API self-use

"Do not make undocumented and unsupported use of one part of an API
from within the implementation of another part of the same API" is one
of the rules of Abstraction Club. Not sure if it's important enough to
be the first two rules, but it's up there.

src/python/grpcio/grpc/__init__.py

@@ -1156,16 +1156,7 @@ def ssl_channel_credentials(root_certificates=None,
         _cygrpc.channel_credentials_ssl(root_certificates, pair))
 
 
-def metadata_call_credentials(metadata_plugin, name=None):
-    """Construct CallCredentials from an AuthMetadataPlugin.
-
-  Args:
-    metadata_plugin: An AuthMetadataPlugin to use for authentication.
-    name: An optional name for the plugin.
-
-  Returns:
-    A CallCredentials.
-  """
+def _metadata_call_credentials(metadata_plugin, name):
     from grpc import _plugin_wrapping  # pylint: disable=cyclic-import
     if name is None:
         try:
@@ -1179,20 +1170,33 @@ def metadata_call_credentials(metadata_plugin, name=None):
                                                           effective_name))
 
 
+def metadata_call_credentials(metadata_plugin, name=None):
+    """Construct CallCredentials from an AuthMetadataPlugin.
+
+    Args:
+      metadata_plugin: An AuthMetadataPlugin to use for authentication.
+      name: An optional name for the plugin.
+
+    Returns:
+      A CallCredentials.
+    """
+    return _metadata_call_credentials(metadata_plugin, name)
+
+
 def access_token_call_credentials(access_token):
     """Construct CallCredentials from an access token.
 
-  Args:
-    access_token: A string to place directly in the http request
-      authorization header, for example
-      "authorization: Bearer <access_token>".
+    Args:
+      access_token: A string to place directly in the http request
+        authorization header, for example
+        "authorization: Bearer <access_token>".
 
-  Returns:
-    A CallCredentials.
-  """
+    Returns:
+      A CallCredentials.
+    """
     from grpc import _auth  # pylint: disable=cyclic-import
-    return metadata_call_credentials(
-        _auth.AccessTokenCallCredentials(access_token))
+    return _metadata_call_credentials(
+        _auth.AccessTokenCallCredentials(access_token), None)
 
 
 def composite_call_credentials(*call_credentials):