Don't serve tmplt files.
Require login in app.yaml.

Now we don't have to check it in the handlers.
Remove an old bug comment.
Merge pull request #28 from eaburns/dev/eaburns

Require login in app.yaml. Fixes #25. Fixes #26