Do not allow applications to change people.

Applications, which could be opened with only an email address, should
not be allowed to set Shibboleth details for existing accounts.

User could not access application without accessing secret that was sent
to email address, however this way we are more secure.

Change-Id: I860425b86c4fe5497a9cec7ac438bf70f0509b76
Update application checks.

Move checks to central place.

Applicants can conflict with each other, however registered people
cannot.

This means we must check application at submission time and approval to
ensure nothing conflicts.

Change-Id: I4e9ce4c12a0efa60b79d0078673eab4ded2d3ad7
Update duplicate saml_id check.

Make sure we don't get confused and check current person at the same
time.

Change-Id: I4050e7a635ec8805beff1382dfa75d2e9020e351