only doing host validation in production mode