Why not AuthenticatedFileHandler here as well?  Couldn't a user have stuff in here they want to be protected?