Fix remote.php routes for apps that are enabled for specific groups

Since checking if an app is enabled requires a user to be logged in we need to postpone those checks until after the *DAV auth is handled, to achieve this a sabre/dav plugin is provided for apps

See owncloud/contacts#563 and owncloud/calendar#502 for the app parts of this

cc @DeepDiver1975 
Do we have this logic somewhere else already that we could reuse ?
Can this be put in the `App` class and/or the suggested `hasUserAccessToApp()` method ?