extractorapp: access restriction no more hardcoded in webapp