Lock down services/* urls

We only want these available to site admin or on non-prod servers.

r?