[refactor][s]: move running of app to run.js to avoid running the app tests.
[#261,login][m]: restrict reviewing to reviewers specififed in config.

* plus tests for permissions enforcement