Unauthenticated handlers

This was a bit odd: core XBlocks doesn't implement handler_url, so there's nothing for it to do with @XBlock.unauthenticated.  And workbench doesn't do any real authentication, so the code there is only slightly different for unauthenticated handlers.

I added some checks in Workbench's runtime.handler_url to check that the function is a handler.  This is an earlier-in-the-workflow version of John's check that the function is a handler, which is done in the handler dispatcher.