sane defaults for -templates, -public
initial finer-grained authentication

there are all sorts of knobs that people will want to turn around auth;
this initial pass only solves for the current use cases.

later on this may get more detailed, and maybe even integrate with
OAuth.

the main page, resource view page, and build view pages are now public.

the API still requires authentication.

a build's log can only be viewed if either:

  a. the user is authenticated, or
  b. the build is of a job configured with `public: true`

[#72940010] [#72843274]