Don't require signed requests by default in production