Update application.xml

Updated definition of "sensitive data" to reflect a well-known source: the Computer Security Act of 1987, as cited in NIST CSRC documentation referred to in the FE PP.