Securing apps without OAuth - ZITADEL