Disable API URLs for security reasons

Created by: bitterjug

Disabling the API urls is a quick fix security measure. Obviously we'd want the api urls to exist -- with suitable authentication in a real system. And it sucks to loose the ability to use the web interface to the API that DRF provides during testing, so here I'm disabling only if DEBUG=False