Clarify how authentication works for /applications.