Fix remote.php routes for apps that are enabled for specific groups

Since checking if an app is enabled requires a user to be logged in we need to postpone those checks until after the *DAV auth is handled, to achieve this a sabre/dav plugin is provided for apps

See owncloud/contacts#563 and owncloud/calendar#502 for the app parts of this

cc @DeepDiver1975 
Mixed `&&` and `and`