Does this mean that if the settings key is misspelled or missing on a production site (say, Stanford's), we default to leaving this API open? If so, could you make the default behavior restrictive, and override that behavior to make it permissive where needed (dev.py, if a key is defined, etc.)?