slight refactor of Security.__getattr__ to avoid recussion when not initialized with app

If you use the factory method for creating at app and call `security.init_app(app)` directly after `security` is initialized, calling `security.anything` (I ran into it with `security.login_context_processor`) ends up with an endless recursion since `security._state` is never set. This slight changes fixes this, but requires that attributes be accessed within an `app` context when they are registered this way (which is the only way I think it could work, if we are able to register with multiple apps).