add developer bypass so authentication "works" without needing to contact an id.wmo instance

[Pomax]

It's very easy to lose a lot of time trying to get a working setup where api.wmo properly talks to id.wmo; adding a dev-mode option via the env so that by default a local instance of api.wmo doesn't need to reach out to a remote (or in fact, any) instance of id.wmo feels like it would go a long way for devs and contributors to not get sidetracked in the work they actually need to do.