api: fix bug in teamUserAdd

That was critical: we used user.AllowedApps instead of team.AllowedApps,
this gave access to all apps that the authenticated user has access,
instead of the apps that the team has access to. Now we just get apps
from the team. It's safer and it's right :)

Fix #539.