restrict `json` query parameter to dev env and logged-in npm employees