refine per-app VPN