The application scope implicitly grants access to the domain that owns it.  Since applications could move, we do the lookup here.  Should be inexpensive enough that we don't have a performance issue (app scopes accessing the domains collection are rare).