Authorize application page now random user, not scope.