load app config only after successful auth check