Authentication: app_name inconsistently used as path param vs body param

[christophdb]

The `app_name` parameter is used as a path parameter in some authentication endpoints and as a body parameter in others. It should be clarified whether this inconsistency is intentional or if the usage should be standardized.