Secure /app/init

can't happen (i guess)