Only display unescaped request in :dev mode, change default to :prod (temp fix for JS injection vulnerability)