Work on API2
- better sysadmin error message
- sysadmin can change apps
- tests for checking callback urls