Apps can hook in their own locator.

Adds #7.
We'll also need to validate that the `app` format is an allowed URI hostname, so no underscores (see #23).