support login with Authorization header
Fire `user_loaded_from_cookie` even if token loader provided
Fix UserMixin hashing with Python 3