require auth for the extra update endpoint in prod

[martbhell]

Looked at disabling it or redirecting it somewhere else but didn't look much easier than this.

https://stackoverflow.com/questions/33489873/block-a-url-path-on-google-appengine