auto-add permissions on new apps, don't allow unpending by non-admins
lost method_override at some point