no_auth_endpoint decorator

This commit introuduces new decorator, no_auth_endpoint, to mark
endpoints that should be accessible without authentication, for
example endpoints that reset password or accept invites.

Change-Id: I6f59a5c0f17dd79bae8ff9990626dfb43e5b3a3b