Should requests using OAuth2 rely solely on the bearer token?

Question

I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps.

• The website will send always send a corresponding referer header.
• The Cordova app will always send an x-requested-with header.

I have two similar questions regarding this.

1. May (or should) these headers be used to verify a client identity when requesting an access token?
2. May (or should) these headers be used in addition to the granted access token to verify the client identity?