Rename AppRole field in App;
Enhance SecurityContext/-Interceptor for REST;
App ids/secrets (except core ones) are already base64 encoded;
First app operations in REST API;
Include Validation API for e.g. NotNull checking of REST-Parameters;