fix(controller): disallow evil users from modifying apps

Authenticated users who were not given explicit permission
to view or modify an app were still allowed to create new releases,
run commands, retrieve logs etc. This makes those requests return a 404
if the user should not be able to see the application.

Please let me know if I missed any loopholes and I will happily correct them.

closes #2820, refs #2811