Do not default sources on new applications

It's the responsibility of a client to configure sources on
a newly-created API key, not the server.