Feature/permissions fixes

I still think we should make it hard to change an app's short