Wrap only webhandler with authentication

Currently auth wraps all handlers if `publiclyViewable` is set to false.
This prevents `turbine` from hitting the callback URLs seeming that the
build never starts or return any result.

Now we wrap only the web handler with auth since the api and callback
handlers have their own authentication.

[#80964318]
Merge pull request #1 from luan/fix-publicly-visible-bug

Turbine can't talk to callback URLs