allow POST from external for OpenID when not in DEBUG mode