More security changes.

- Make the datasync post request only work on the dev server.
- Add email as a sensitive field that will be removed.