New request_loader for customizing user login

Fixes #143.

Added:
* new `request_loader` callback to handle all custom login cases
* depreciation warning about `header_loader`
* documentation for Custom Login using Request