support application-only auth

I've made an application only auth class.
cf. #318