API Key authentication should take precedence over cookies

[arikfr]

Currently when you're logged in as a user, you can't use embeds or shared dashboards for which you do not have access -- even if you provide the API key. This is because the current user is being defined by the session cookie and the API key is being ignored.

We need to change this behavior so the API key takes precedence. From a quick look at Flask-Login's documentation, it seems that it calls user_loader first and only if this fails will try the requets_loader.

Unless this is configurable, we might need to change user_loader to always return None and implement our own logic in request_loader.