On the step Call your application from its secure route I got a 500 internal error when calling https://approuter-<my-app-host>.cfapps.<global-account>.hana.ondemand.com/products.
It turns out there was 1 less binding than required (products-list was bound to the xsuaa service instance but the approuter app was not)
Fixed following https://me.sap.com/notes/0002949591