Moving my website to different server changes authentication from Kerberos to NTLM

What you have is a classic double hop situation. The graphic in the following post is pretty much your exact situation:

http://blogs.technet.com/b/askds/archive/2008/06/13/understanding-kerberos-double-hop.aspx

When both your 'client' and 'service' are on Server1, there is only a 'single hop' to authenticate the user. When you introduced Server2 into the mix, you now have the double hop where authentication is now delegated.

Since you are running your app pools as a domain account, you will need to setup service principal names (SPNs) in order to prevent the double hop. There are resources mentioned in the post above. There is mention of it in this article as well:

http://msdn.microsoft.com/en-us/library/ff649309.aspx

A SPN will need to be created for the specific user account, service, and host name. This needs to be done on the domain controller.