Bug 1023296 — Accept "app" scheme if domain matches.

https://bugzilla.mozilla.org/show_bug.cgi?id=1023296
The logic here to support app:// audiences concerns me from a security perspective. Does the caller ever expect it to be anything other than an app:// URL? It would be nicer if this could be removed and the caller just provides the app:// URL explicitly.