Ability to force host used when redirecting

[alanhamlett]

Flask-Login's default unauthorized handler uses Flask.redirect to redirect to the login page. When a request is made to a route decorated with @login_required, then Flask.redirect correctly uses the Host or X-Forwarded-For as the host part of the redirect url.

This is fine, except in SSO applications or pen-tests. For those who don't mind breaking proxies, this PR adds a new config FORCE_HOST_FOR_REDIRECTS that always overwrites the host in flask_login.utils.login_url which is used when redirecting to the login url.

[coveralls]

Coverage remained the same at 100.0% when pulling ebf83b1 on alanhamlett:force-host-for-redirects into 61d0848 on maxcountryman:master.

[alanhamlett]

Related to #353 and #354 and pallets/werkzeug#609.