move /api/applications to /secure/applications