Move request verification to ApiApp

Every ApiApp should verify requests this way

Change-Id: I2f0ebf693719082ecd7f49e8f72abf18ed33233d