Don't set the Server header in production.

To pass most UK government penetration tests, the web / application
server should not expose version details, or ideally product details.
This change avoids defaulting the Server header in production mode if
none has been set by the application.