if you're checking for distinct app and user, you'll likely want to use two checks, unless the user and app are linked in some way directly