ongoing users / groups refactoring
  - added initializeDeep function calls to some methods to get eager results
  - added methods for getting the granted application of a user
  - secured gizmo to only show granted (by group and owner) applications