moved grant app constants into model

#434
unique emails

#436
grant viewing permission check

closes #430, needs testing