app: some more constructor security