$app is now protected