Protect debug http handlers; add warning in flag