No global app2

This is a clean up (rebased against session-cookie-approach) which I will then use as the origin branch for the ACLs pull request 

I got stuck hunting down a foolish bug (#7f0b4be60) so this took longer than expected.