Lock down the /docs API

[PaoloPedin]

Currently the /docs API is not locked, so it can be dangerous in production environments. It would be safer to find a way to lock the API URLs (via reverse proxy or some other method)

[pieroit]

Decided at dev meeting that:
1 - there is no risk if you set keys and jwt secret
2 - as you suggested, to hide /docs, you can add a simple proxy rule