The CONFIGs definitely needs to be in the bootloader code that gets programmed to the chip using a real device programmer.
You should not allow the downloaded "application" to change the CONFIG (besides it's not even possible on all PICs) because it might brick it. For example, if the bootloader is written for a board using a HSPLL oscillator running at 32MHz and the user, by mistake or unknowingly, downloads a piece of code that changes the oscillator CONFIG to INTOSC. This bricks the device and you need to reprogram it with a device programmer.

/Henrik.