web app doesn't require a valid login if launched in debug mode