Permission fix for dynamic dashboard navigation

The code assumed that an application instance and it's views have the
same parent module. This is not necessarily true, as one can customise
either just a view or just an app.
The fix consists of always using get_class to load the application
instance.

@mberthau pointed out the issue and provided a first fix in #993 and #1034.