add a full stack app test
rename no-security method
fix app_test