fix maxcountryman/flask-login#149 by preferring request_loader over header_loader