Allow setting public key in headers and/or query

This is the first step in a set of changes required for the new ACL implementation discussed in #319.

Basically, it allows overriding the "publickey" specified in the URL/route by using HTTP request headers (`X-Imbo-PublicKey`) or a query parameter (`publicKey=<pubkey>`).