Fetching `user_uuid` off the params is a security hole--it lets someone craft a post that creates an application for some other user. It's a small hole--I can't figure out what actual havok you'd wreak by doing it--but we should close it anyway. Rather than using the request param, use `current_user.uuid`