code: public static App getPrincipalApp() {
  		App app = SecurityUtils.getAuthenticatedApp();
  		if (app != null) {
  			return app;
  		}
  		// avoid reading app from DB if it's found in the security context
  		app = SecurityUtils.getAppFromJWTAuthentication();
  		if (app != null) {
  			return app;
  		}
  		app = SecurityUtils.getAppFromLdapAuthentication();
  		if (app != null) {
  			return app;
  		}
  		User user = SecurityUtils.getAuthenticatedUser();
  		if (user != null) {
  			return Para.getDAO().read(Config.getRootAppIdentifier(), App.id(user.getAppid()));
  		}
  		logger.warn("Unauthenticated request - app not found in security context.");
  		return null;
  	}
docs: Returns the current authenticated {@link App} object.
  
  @return an App object or null