allow configuration to disable feature modification at run time

In our use case it's ok to have an unsecured endpoint to toggle features in dev and test environments, but not for prod.

This change allows a config setting to prevent the feature toggling endpoints to be used.