Require auth for GET /leads in production