disabled app-loading by default (it's probably not too secure)