Support tornado get_current_user

Allow users to specify a function to use for Tornado's `get_current_user`:

https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.current_user

And use the `authenticated` decorator when applicable on endpoint handlers
