Custom request loader

Flask-login allows authenticating every request through a request loader (i.e. rest API auth)
and added the request loader, the api key generation is for now left to the user (i implemented it as hash of the concatenation of user email and concatenation of random/secret data) and it could be added to the UserMixin class.

there's also this p.r. for flask-login https://github.com/maxcountryman/flask-login/pull/163 to avoid having unneeded cookies, at the moment is a global config, but it could be hacked to ensure that if it's a request for the request loader session can be cleaned, but would require more effort.