It relies on the r_fullprofile permission when authenticating users, which means I will have to get the application approved before the grace period ends (May 2015).