Fix remote.php routes for apps that are enabled for specific groups

Since checking if an app is enabled requires a user to be logged in we need to postpone those checks until after the *DAV auth is handled, to achieve this a sabre/dav plugin is provided for apps

See owncloud/contacts#563 and owncloud/calendar#502 for the app parts of this

cc @DeepDiver1975 
I understand that we don't want more than one call to assert that the user has access, so I suggest to put the `hasUserAccessToApp()` call inside of `checkAppEnabled()`.

Also it is not clear yet why there are cases where we don't want to check for the user like here where it's false ?
Would it be possible to remove that case altogether ?