the semantics is strange: once we're updating an application, we should be pretty sure about which app we're updating, so app_id is known very well, isn't it?