so if the host is going to serve anything app-specific without requiring a key, that stuff needs to be specified statically in advance at a time when the grain is running