Add toggle to disable the online-rejection mechanism (DoS attack)

[this-kramer]

1. Time-based: Disable for x seconds to avoid test users messing with demos
2. Hard toggle for demos: Maybe hidden api call such that it is not clicked accidentally :)

quick-and-dirty solution for hard toggle: time-based toggle with a time period that hopefully will not expire during any demo (i.e. 1 day)