api: Require that X-TBA-App-Id be non-blank

This disallows headers like `::`, `a::`, or `:a:`.