Move list handlers into web/; prevent viewing private repos when not signed-in