Document app ID requirements in REST.md

App IDs must match `/^[a-z0-9.-]+$/` currently, and that should be
documented.

Fixes #314.