It seems that the use of complementary technologies may be the comprehensive answer to the network/application layer question.

An application-level security scheme like SSL can serve as the upper layer's security, while a protocol like AH could be used in the network layer to prevent spoofing. Each individual case will require an individual decision as to whether to use application-level security.

The developer must be always aware that there are no "magic bullets" and one size won't fit all. While there are general principles of security, the exact mix used should fit the situation at hand.