Only check OCS-APIREQUEST header in case of an apptoken

We should only check the OCS-APIREQUEST header in case of an apptoken. Otherwise we should always require the presence of a CSRF token. (in the past there have been bugs that would allow an attacker to set arbitrary headers potentially cross-origin)

Ref https://hackerone.com/reports/1023822