Fix: app can delete own authorizations