improve the description of 3rd party app handling

 hopefully dealing with lots of confusion about that. Also linking to the security article.