this makes more sense than (potentially) adding a whole bunch of methods to the app handler. also fix entry point for app provider, per wj changes
default menu is not yet useful, but the handler mostly works. except for actual auth/perm checks since we have no users yet!