disallow private api injection for apps other than core or settings (settings should be an app goddamnit :D)