These tokens are provided to flat-manager to authorize the user to
download an app. In the future, this enpoint should first check whether
the user has paid for the app if necessary.

Add a table, UserOwnedApp, to track which users have bought/otherwise
have access to which apps. Currently there is no way to add entries to
this table; that is part of the payment processing work.