auth: improve Team.RemoveUser
auth: move User.AllowedAppsByTeam to Team.AllowedApps

Related to #470.
api: don't remove all teams from Gandalf

Fix #470.