api: always use the parameter ":app" for app name in handlers
api: validating application tokens on authorizationRequiredHandler

It is able to check for the application name (the owner of the token)
using GET parameters or header entries.
api: require authorization on healers handler

Closes #290.