Don't authenticate GET requests to the root URL

This will allow us to present helpful information. Like how to log in!
Move auth and token handling out of main class

This allows us to more granularly define which views are and aren't
authenticated without having to undo settings in a bunch of places.
Added max_request_body_size as a config option and lowered the default
Moved example config to the top of the docs
Added note that config options do not apply to external servers
Removed unused os & textwrap imports
Moved web hook security notes closer to the top of the docs
Improve documentation on the new stats URL
Require authentication for the stats URL