apps: allow update if identity/app public