Applications should be able to have multiple owners

WIP ...

For private client apps to be usable, more than one user should be able to use them to authenticate/authorize

TODO: delete client app when last owner is destroyed
TODO: more cleanup