Disable injection unless command line flag present to be somewhat more
secure by default