Instead of ignoring URLs in the auth tool, disable tool in each handler

Better not to couple a tool to a handler. Not sure why I didn't think to
do this the first time around.
Removed redundant exposed