@wangxinnong - When you create an ACL app from AppHQ Dashboard. It will be reqired to passed the session id of that user for which you are making a request or direct passed the admin key for securing your app.
Please have a look on our tutorial which help you to understand that how you can secure your app.
And if you have any other query feel free to ask.