App-based security checking now enabled for shared form-entry pages. AppDescriptors moved into the api layer and referenced directly by FormDescriptors