Implement a mechanism to allow unauthenticated requests for specific endpoints

[mcucchi9]

This PR implements a mechanism to allow unauthenticated requests for specific endpoints, and allows unauthenticated requests for apply_constraints and estimate_cost endpoints.

Details
Endpoints with forbidden unauthenticated requests requires an authentication header to be sent, otherwise return a PermissionDenied error.
Endpoints with allowed unauthenticated requests doesn't require an authentication header to be sent, and in this case set the internal user_uid variable to unauthenticated.

Also, the Referer endpoint is now used to help determine the request origin in case the request is not authenticated: if it is present, the request origin is set to ui, otherwise it is set to api.

Why it's useful
Before, apply_constraints and estimate_cost didn't required authentication, so they already allowed unauthenticated requests. For https://jira.ecmwf.int/secure/RapidBoard.jspa?rapidView=401&view=detail&selectedIssue=COPDS-2811&quickFilter=1278# and #257, though, we need a mechanism for:

• trace users making requests;
• allow for unauthenticated requests, tracing their rate;