Handle requests only from allowed users

[pablo-de-andres]

A lot of registered applications right now do not check that the user is actually allowed to request the resources.
This should be tackled in two steps from the application side:

• Only allow requests coming from a logged user (check the token in the request)
• Check/validate that the user is authorised to make a given request (e.g. by querying the platform to see if the user purchased a product for the application).

Since the dummy app serves as a starting point for development, it would be beneficial to include these functionalities out of the box.
This concern raised on the platform applications meeting on 22/03/22.