Allow setting public key in headers and/or query

This is the first step in a set of changes required for the new ACL implementation discussed in #319.

Basically, it allows overriding the "publickey" specified in the URL/route by using HTTP request headers or a query parameter.