Temporar disable APP_SLUG in routes

In search of cookie stealers. Although non-public apps should probably not
even have it (?).