Disallow request-based audience anywhere but dev