auth_field can be dynamically set per request.

When determining what the auth field is, flask.g.auth_field is now looked up first, falling back to the resource's auth_field definition if necessary. In particular, this allows Auth classes to affect how a resource is restricted based on the requests authentication.