Disable security headers in non prod environment

[Fixes #133]