fix a issue where the watch will sometimes send back a "app deleted" msg
implement xhr authentication