return app id as part of security lookup, cleanup comment
some features to allow verifying the client and server match