If it makes sense to restrict which applications people can replay and report on, why aren't snapshots included in this?

In creating an application, prompt to associate the domain names. Then the snapshots for domain www.ibm.com can only be seen by people with access to the application associated with www.ibm.com

This may help with the problem of the snapshot page taking a long time to render on the first hit. (Which BTW needs a loading indicator).