web.authenticated: allow 403 without redirection

The @web.authenticated decorator will always redirect with a 302 when the user is not logged in and the method is GET or HEAD. There is currently no way to return a 403 error for GET/HEAD requests using the decorator.

This is OK if the request comes form a web browser that expects HTML, but not if you are developing an API that's meant to be consumed using other methods.

Here's my proposal:

• Allow the get_login_url() method to return None. Have the default implementation return None when login_url is not set in the config instead of raising an exception.
• Have @web.authenticated return a 403 when get_login_url() returns None instead of redirecting.

Start by locating the web.authenticated decorator and get_login_url implementation in the Tornado source, then inspect their existing authentication tests. Verify the behavior for GET and HEAD requests with and without a configured login URL; done means an unset URL produces a 403 while configured URLs retain the current redirect behavior.