title: Issue Application Id for each kind of Client Application
body: <p>I'm using <code>Microsoft Owin</code> and <code>ASP.NET WebApi</code> for authentication and authorization process for my client application. Also the authentication server is secured by <code>HTTPS</code>. I've read a few articles about using <code>Microsoft Owin</code>, one of them which I've chosen to implement is:
  <a href="http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/">Token Based Authentication using ASP.NET Web API 2, Owin, and Identity</a></p>
  
  <p>There are some differences between my project and that implementation:</p>
  
  <ol>
  <li><p>I need to identify my client in case the request is sent by my application on the mobile phone, not any other devices or tools like Fiddler. I think one the options could be sending an application id by each request from the mobile application. But I don't know how and where should I verify the requests in authentication server application. This is really important for registering users:</p>
  
  <pre><code>    [AllowAnonymous]
      [Route("Register")]
      public async Task&lt;IHttpActionResult&gt; Register(UserModel userModel)
      {
          if (!ModelState.IsValid)
          {
              return BadRequest(ModelState);
          }
  
          IdentityResult result = await _repo.RegisterUser(userModel);
  
          IHttpActionResult errorResult = GetErrorResult(result);
  
          if (errorResult != null)
          {
              return errorResult;
          }
  
          return Ok();
      }
  </code></pre>
  
  <p>I don't want to let unreliable devices, i.e. the clients except the mobile application, to call this method.</p></li>
  <li>I need to let anonymous users to buy some products from the website, but I don't know what is the best practice to issue token for anonymous users without doing authentication.</li>
  </ol>