A lexicon-driven AppView for ATProto.

fix: prevent identity spoofing via /oauth/sessions master

Signed-off-by: Trezy <tre@trezy.com>