Create Authorization model and use it to maintain notification settings

Move notification settings to authorization object (one per authorizated user/application pair)