app.yaml: add comment to disable secure directive when deploying demo