Kernel specs REST API

The [REST API for kernel specs](https://github.com/ipython/ipython/wiki/IPEP-25:-Registry-of-installed-kernels#rest-api) is described in IPEP 25.
It looks like FileFindHandler, which we use for nbextensions, isn't authenticated either. Possibly we should fix them both. I don't think anything in kernel spec directories is likely to be private, though.

As to metaclasses: I'd say that's a step too much magic. I think having to explicitly mark handlers as authenticated is probably a good thing.