check bearer token is hex. fixes #157
turn off management routes in prod