App views

finishes up app view routes (the app can GET from /app/contacts/<access_token> and receive the contacts in json. same goes for messages