Require client_id in /user.json endpoint

This makes this parameter mandatory when an application is asking signon for
information about a user trying to authenticate to it.

Follow up to 6e33fd1eff8b01a4478ba9cc6e3ac54676147683

This change means that Signon will always check that the token the user has
supplied is for the application making the request, rather than another
application.

This is blocked until @tombooth and co have updated and released their apps to supply the parameter.