fix maxcountryman/flask-login#149 by preferring request_loader over header_loader
Merge pull request #150 from alanhamlett/master

fix #149 by preferring request_loader over header_loader