moved app authorization to separate module
created basic preferences resource

read-only and plain text for now

NB: we're using a blacklist approach - that is, unless an application
has been explicitly muted ("suppressed"), we're assuming the user wants
the respective notifications