Secure /app/init

return cb, not next