Allow overriding of an unauthorized callback.

Right now, when using `@http_auth_required` or `@auth_token_required`, if the user is unauthorized only a message is returned (`_default_unauthorized_html`).

With this change, it is possible to define an unauthorized callback which will be called instead.

Example using your overholt project (`overholt/api/__init__.py`):

```python
from overholt.core import security

def unauthorized():
    return jsonify(dict(error='Unauthorized')), 403

def create_app(settings_override=None, register_security_blueprint=False):
    app = factory.create_app(__name__, __path__, settings_override,
                             register_security_blueprint=register_security_blueprint)
    security.unauthorized_handler(unauthorized)

```

I have tested it only with `@http_auth_required`, but `@auth_required` and `@auth_token_required` should work pretty much the same.