move theme installation to plugins, allow installation only when $app['debug'] is set to true for security reasons