Add application-only authentication

For many endpoints, it's possible to authenticate with just the
application credentials and no user credentials at all. In this case,
the application has its own separate rate limit (sometimes higher than the
user-authenticated version), so it's possible to make at least twice as
many requests per 15-minute period if one uses both the application-only
and user-authenticated credentials.

This commit extends `make-oauth-creds` with a new arity that takes two
arguments: the `app-key` and `app-secret`, returning the
application-only token. The `get-request-args` and `oauth-header-string`
functions are similarly extended to properly handle the application-only
auth map.

Finally, the `is-200` macro is extended to take an optional `:app-only`
arg, which causes the given function to be called with application-only
credentials (see `make-app-only-test-creds`). I added additional tests
using this macro where appropriate.