API: Replace HTTP Basic auth with static key in custom header

Given that the key is sent in a custom header, this should prevent
any possible CSRF attacks.

Fixes #1769.

Conflicts:
	pdns/docs/httpapi/README.md
	pdns/docs/httpapi/api_spec.md
	pdns/docs/pdns.xml
	regression-tests.api/runtests.py

Updated:
	pdns/webserver.cc to work with older recursor include files.
	pdns/dist-recursor to reflect changes in paths.