Fully switch to id skill verification

Currently it's still done optionaly in code using an `APPLICATION_ID` setting, if supplied by the user.

AWS has released a way to do this as part of the setup, so that only your Alexa skill can even invoke the Lambda (cheaper and better):

https://developer.amazon.com/docs/custom-skills/handle-requests-sent-by-alexa.html#request-verify