don't call into app in startup

this avoids the nasty call to secrets which accesses the database