Support `ServerApp.allow_unauthenticated_access = False`

[Michał Krassowski]

With c.ServerApp.allow_unauthenticated_access = False I see:

│ Exception: Core endpoints without @allow_unauthenticated, @ws_authenticated, nor @web.authenticated:
│ - GET of JupyterHubLogoutHandler registered for /user/myname/logout                                                                                                                                                                                                                                                                                                                                                                      
│ - GET of JupyterHubOAuthCallbackHandler registered for /user/myname/oauth_callback

Both endpoints are likely safe to mark as @allow_unauthenticated (I am less clear on logout one).