Add master key header only if no user session is specified

Hi,

I've added this check to avoid including master key if a user session is specified in the request header. By doing so, you're able to call a function as a user, and not as the master, even if you've initialized the application with your master key.

Ex:
```python
user = User.login(username, password)
hello_func = Function("hello")
hello_func(extra_headers=user.session_header())
```

 It can be convenient when in your script you have to switch between master and simple users.

What do you think?