Use envoy or some other reverse proxy and do per-app auth there