Default to production

I think setting the app env to 'production' by default is safer/easier.

1. In case the developer is lazy in setting the NODE_ENV on the server, the app is still is a secure operating mode.
2. It is much easier to set NODE_ENV to development on a local copy of the site than it is to set NODE_ENV to production on a server.