The Applications admin page wasn't properly protected