recommend/require Accept-headers, and show them in examples

Since in-the-wild implementations also sometimes use/default to form-encoded in some places this spec requires JSON responses, it might make sense to state that clients SHOULD/MUST set an `Accept: application/json` header. Or is the intention to hunt all of them down and change their behavior?

Review the IndieAuth specification text and its examples to identify where JSON responses are described and where request headers are shown. Clarify whether the change is limited to documenting an Accept header or also requires tracking down implementations; done means the agreed requirement is stated consistently and the relevant examples are updated.

Written by the indexing model from the issue text.