Feature user limitation [rebased]

hello,

This is still a work in process and I need a bit of guidance/advice where to place the code (so we dont drift away from the oauth spec).

The idea is to evaluate a block to see if the `current_resource_owner` is allowed to acquire access to the application. This can be handy for many reasons, like an admin app only accessible if the user is admin, creating users and then assign the applications they can access and so on.
```ruby
resource_owner_allowed_for do |app_id, current_resource_owner|
  false
end
```
What I would like to add/change:

- Correct place to place the check if the current_resource_owner is allowed the requested application, this is now done in the `pre_authorization` as an extra validation