Change from decorator to handler_url argument.

Rather than decorate the handler as an unauthenticated handler, instead
indicate that when getting the URL to the handler.  This gives us the
ability to provide authentication eventually, and lets the Javascript
handler_url() function also produce these URLs properly.
Make handler_url and resources_url properly abstract