Should server API key loaders accept NEXT_PUBLIC fallbacks?