Support login using header instead of cookie

This change supports authentication using an api key or token value from a request header.

New things:
* decorator `login_manager.header_loader`
* config `AUTH_HEADER_NAME` with default value `Authorization`
* signal `loaded-from-header` fired when a user is logged in using the header loader