only do api security validation for production env