$app should be protected