Secure /app/init

return the same message as below (and add a comment explaining why)