Can login_required by applied to an entire app?

Yes, you should use middleware.

Try to look through solutions which have some differences:

• http://www.djangosnippets.org/snippets/1179/ - with list of exceptions.
• http://www.djangosnippets.org/snippets/1158/ - with list of exceptions.
• http://www.djangosnippets.org/snippets/966/ - conversely with list of login required urls.
• http://www.djangosnippets.org/snippets/136/ - simplest.