Don't serve tmplt files.
Require login in app.yaml.

Now we don't have to check it in the handlers.
Remove an old bug comment.