Only require auth in production