uniqueness on user/app/key