Fix: app post refs app auth post (oauth authorize)