The feature flag was added to prevent the following scenario:

1. Atlassian loads the old version of app_descriptor_controller.rb from production.
2. A user installs the app and the installed request hits canary.
3. The JWT header does not contain a kid and the JWT verification fails.

Changelog: changed