Enable security only in production mode

Leave Rails development mode insecure so that we can still test easily.