I agree. A couple common use cases I can think of:

* I want to develop an extension that won't be returned by the API for my user (either it doesn't exist yet or it exists but i don't have perms for it)
* I want to develop/test a combination of multiple extensions, some of which could be "prod" extensions served from S3, some of which could be "dev" served locally on my computer

Would it make sense to allow a dev user to override the array of extensions for the user with their own set (maybe via an env variable), rather than manually overriding the address in this code?