Condensed a lot of handler code into 'controllers'. Going for a more MVC-esque pattern however may refactor the name out as it is not really appropraite for Tornado.

Also found some bugs relating to unauthenticated access due to poor understanding of decorators.