Unauthenticated handlers

This was a bit odd: core XBlocks doesn't implement handler_url, so there's nothing for it to do with @XBlock.unauthenticated.  And workbench doesn't do any real authentication, so the code there is only slightly different for unauthenticated handlers.