and serve / banner and robots to anon users.

instead of returning 401 for all cases, I treat the unauthenticated case
as a special case, and switch the service tree apart.

this allows to serve a different resource tree to unauthenticated users.

the new URLs are registered with the mapper.
I don't really like that dependency, could be handled by twisted alone, but meh.

- Resolves: #8764