Staging: auth bypass is on for VPS testing only. Turn off STAGING_AUTH_BYPASS before a public launch.