Fix optional app and required app.user and app.group.

From the spec "app" is optional. I made it a pointer to avoid the validation of an empty field. This will affect applications using this package but this is usually the way go json handle empty json and I didn't find a better way.

Also user and group are defined as required so I added a validation.