Pull the hashkey from the request headers.

Instead of passing the hashkey in the URL itself, it will be passed
via the blind id header similar to submissions. This will help to
ensure that it is a Xonotic client or server making the request.