Good day.
Removing server application with "remove app" command just disables REST hooks for events associated with this app, but this does not disable client requests to server.
So if you need to authenticate server connections, you shoud not remove defaultApp, but you should update it to send...