restrict app param

who-am-i/src/server.rs

···
             Some(parent_host),
         );
     }
+    if let Some(ref app) = params.app {
+        if !allowed_hosts.contains(app) {
+            return err("Login is not allowed for this app", false, Some(app));
+        }
+    }
     let parent_origin = url.origin().ascii_serialization();
     if parent_origin == "null" {
         return err("Origin or referrer header value is opaque", true, None);