fix(controller): expose app URL

While users should not have access to the clusters endpoint, they
should still be able to see what root domain their app is currently
being served at.

closes #903