Application should be a required header

[jcoyne]

This will allow us to track useage per downstream application.

[jcoyne]

I found that swagger-go doesn't support two simultaneously required authorization headers, so I'm working on investigating JWT as a mechanism for transporting both values in the same token.