ExternalAuthentication: add a substitution variable for accessing any header value of the request

This commit also changes the remote URI syntax. Substitution variables are now
enclosed by brace brackets instead of being started by '$' character.