Don't do MDES configuration if we're not in app mode.

(Clearly I should find a better way to defer this sort of stuff.)
Use automatic_access authority.

We could introduce the NCS Navigator Authority here, but I don't think
we need to.  Pancakes per se really only cares about authentication;
authorization is handled on each service it contacts.
Permit RAILS_ENV customization on deploy.

(We don't always deploy to a production environment.  Sometimes it's
staging.)