Don't allow cookies to override flags if production

// cc @commuterjoy