api: Require that X-TBA-App-Id be non-blank

This disallows headers like :: or a::
api: Add test cases for X-TBA-App-Id