Allow app only requests