Try more headers other than just X-Forwarded-User

The following headers will be tried for authentication:

- X-Forwarded-User
- REMOTE_USER (and Remote-User)
- HTTP-Remote-User (and HTTP_REMOTE_USER)

The later are particularly useful when Etherpad is reverse-proxied
behind Apache, with the later doing the authentication.