do you do something differently if the app is allowed to access the apiresource but the user is not?