Can you write the line where you are using the _locale parameter?
Make sure you don’t add the double quotes around the language code when using the Thymeleaf function. Like this: <div data-th-text="${portal.localize({'_key=user.greeting', '_locale=nn-no'})}"></div>
The example of the HTTP Request in the docs might be a bit misleading. The "headers" object will include all the headers in the request. But there will not be such a “Language” header (unless you have some custom logic in the client).
What you normally get is an "Accept-Language" header containing the language preferences as configured in the browser. Depending on the languages and order you set in your browser you will get a header like this:
We do not parse the Accept-Language string, so you have to implement your own in the controller to get the preferred language code string, and pass it to the localize function.
I think the resolving from the header to the localize language code might be a good function to add to the i18n module, in a future release.