Validate client_id in /user.json endpoint

Previously, there was no way for this endpoint to ensure that the client
application requesting the user information was the same app that the
token had been issued for.  For normal user tokens, this isn't really an
issue because they are unlikely to ever be different.  For API users,
this becomes a significant issue, because the tokens are both
long-lived, and also exposed to users.  This means that an API token
issued for one app could be used to gain access to a different app.

This change adds a client_id param to the /user.json endpoint to hold
the oauth_id of the requesting app.  If given, this will be validated
against the token used to ensure that they match.  Once we have updated
all the client applications to send this param, it will be made
mandatory.
one minor suggestion: `head :unauthorized` does exactly the same, but is succinct. rest looks good!