api/app: lock app for changes during operations with side-effects

This is not ideal yet.

Right now there's a middleware responsible for locking and unlocking the
app during the request. However, some requests start goroutines that are
responsible for changes on the app.

Ideally each handler should be responsible for releasing the lock on the
app on the appropriate time. This will be implemented in future commits.
api: start, restart and stop are now POST requests
cmd: start, stop and restart as POST requests in cmd
app: tsr is not a valid app name
save deploy error as string
Merge branch 'master' of github.com:tsuru/tsuru
auth/oauth: tries to create user on gandalf on login
api/app: fixed tests in servers with different timezones
cmd: avoid unnecessary calls to /auth/scheme