api/auth/simple: verify that SimpleAuth is only invoked in debug mode