Add application-only authentication option

For many endpoints, it's possible to authenticate with just the application credentials and no user credentials at all. In this case, the application has its own separate rate limit (sometimes higher than the user-authenticated version), so it's possible to make at least twice as many requests per 15-minute period if one uses both the application-only and user-authenticated credentials. See [Twitter's docs](https://dev.twitter.com/oauth/application-only).

This commit extends `make-oauth-creds` with a new arity that takes two arguments: the `app-key` and `app-secret`, returning the application-only token. The `get-request-args` and `oauth-header-string` functions are similarly extended to properly handle the application-only auth map.

Finally, the `is-200` macro is extended to take an optional `:app-only` arg, which causes the given function to be called with application-only credentials (see `make-app-only-test-creds`). I added additional tests using this macro where appropriate.