Allow to provide access_token via env var

[VaiTon]

Use case

I'd like to share my repo with the challenge authors, without giving them access to my personal CTFd token.

Proposed solution

The env var CTFD_TOKEN should be merged with the config before checking if it is set, so that I can either add the access_token to the config file or export the env var.