Permanent Custom Post Type

The built in post type definitions aren’t stored in the database, they’re registered on every request, just like custom types. There’s no way around this.

If you just want to check the request and your logged in state as early as possible, you can use the parse_request action:

function wpd_parse_request( $request ) {
    if( !is_user_logged_in() && isset( $request->query_vars['app'] ) ){
        wp_redirect( wp_login_url() );
        exit();
    }
}
add_action( 'parse_request', 'wpd_parse_request' );