> same as above - first autthentication - then filesystem and logging.

Done.

> We should really keep the loadApps call in base - we don't want to load apps in all public.php and remote.php.

Actually I need to be able to intercept the currently accessed application also from remote.php and public.php (e.g. Token-based logins per application base or the Firewall). Any suggestion how to do this "properly"?

> Besides unnecessary code duplication every dev has to call this in the apps public and remote scripts

I don't quite understand what you mean by this. Can you please elaborate?