Secure app with user permissions; add specs to confirm permissions are configured correctly

Which record is being checked? At the apps_controller, index isn't using authorize(), so this is not barfing. I think the appropriate here is would be just check for user presence, and then at the controller level, do

```ruby
@apps = current_user.apps
```