maybe with a pre-process function using
apex.procedure.preProcess? (plsql? return (select app_id from dual where app_id in ('100')) style?
or using a wildcard configuration with
so far I've not been successful with my simple example (above). It's sad that documentation for these features are so minimal.
I went the route of using URLREWRITE and allowing only certain app ID's in the URL and redirecting otherwise.. it requires editing the xml configuration file to maintain it, but it works.