Secure /app/init

let's reuse req.organization