Change from decorator to handler_url argument.

Rather than decorate the handler as an unauthenticated handler, instead
indicate that when getting the URL to the handler.  This gives us the
ability to provide authentication eventually, and lets the Javascript
handler_url() function also produce these URLs properly.