Removed incorrect app_id filter.

The rest call already determined acl_access, and app_id is wrong in case
of shared assets.