support app secret proof with app access token requests

Hash an app access token with app secret to generate [an app secret proof](https://developers.facebook.com/docs/reference/api/securing-graph-api/ "Facebook: securing Graph API calls"). Include the hash in future app access token server-to-server calls.