Disable Loki VS by default

Loki's virtual service is enabled by default right now. The API doesn't have any internal authentication mechanisms, so we need to disable it and call out to customers that it's not secure to expose it externally.