Allow API calls on private apps

Do this by not forcing an installation of the app, and instead usign the
shop_domain from the config. No enforcement of this is done at this stage, it's
assumed you know what you're doing.