Secure /app/init

let's rename that to ensureValidHash?