smelly kludge to remove appfirst security fail