Application blocklist
We need to refuse to grant application credentials as well as retroactively revoke access to apps on a configurable blocklist. This is intended for blocking broken apps or apps which have unacceptable behaviour like Tootdon. The admin should be able to override the blocklist if they wish.