Auth: updated "check app" method to return full access in `matchingAccess` and `mismatchingAccess`