Improve authorisation for our needs.

This changed the authorization model as follows:

* users can see all apps without having to be watching them
* users can watch and unwatch apps to control whether they get email notifications for them.