`$app_details['terms_of_service_url']` should be escaped with `esc_url()`