This reverts commit 8db1b930f3.
Since cli_wallet itself makes no effort to be stateless, we
can simply unlock in a separate call. Removing the ability
to use the header to unlock reduces the potential for user
confusion about whether the HTTP API provides security
(it does not).
417f869dea