Turbine can't talk to callback URLs

The authentication handler wraps all handlers now.
This PR makes it so it will only wrap the web handler. Giving turbine the ability to call the callback urls even when ATC is totally private (`public_visible: false` and basic auth enabled).