if (ctx.request.body.application) {
            if (ctx.request.body.loggedUser.extraUserData.apps.indexOf(ctx.request.body.application) <= -1) {
                ctx.throw(403, 'Forbidden');
            }
        } else {