Authenticated but unauthorized users may enumerate Application names via the API