* feat: make api token optional for user api routes

* config: disable deprecations in production php.ini files

dev should probably override this setting, but keeping it as-is for now