There should be nothing related to debug mode, can you please check it again? If still same problem do below settings:

1. Make a Log for security related stuffs or other variables in a processor before/after below processor just to check what your request is doing.

<processor type="Sitecore.ItemWebApi.Pipelines.HttpRequest.CheckMode,
Sitecore.ItemWebApi" patch:source="Sitecore.ItemWebApi.config"/>

2. I'm sure you must have applied below settings, still mentioning here, coz being developers sometimes we miss small things :).

Allow anonymous access or request through valid credentials in the \App_Config\Include\Sitecore.Speak.ItemWebApi.config file like below. Also, Make sure to give proper site name, here it's "website".

<site name="website">
  <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
  <patch:attribute name="itemwebapi.access">ReadOnly</patch:attribute>
  <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>
</site>

OR in Sitecore.Services.Client.config file, do below changes.

<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

For more details, you can refer page#13-15 of the Web API PDF guide - https://sdn.sitecore.net/upload/sdn5/modules/sitecore%20item%20web%20api/sitecore_item_web_api_developer_guide_sc66-71-usletter.pdf

There should be nothing related to debug mode, can you please check it again? If still same problem do below settings:

1. Make a Log for security related stuffs or other variables in a processor before/after below processor just to check what your request is doing.

<processor type="Sitecore.ItemWebApi.Pipelines.HttpRequest.CheckMode, Sitecore.ItemWebApi" patch:source="Sitecore.ItemWebApi.config"/>

2. I'm sure you must have applied below settings, still mentioning here, coz being developers sometimes we miss small things :).

Allow anonymous access or request through valid credentials in the \App_Config\Include\Sitecore.Speak.ItemWebApi.config file like below. Also, Make sure to give proper site name, here it's "website".

<site name="website">
    <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
    <patch:attribute name="itemwebapi.access">ReadOnly</patch:attribute>
    <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>
</site>

OR in Sitecore.Services.Client.config file, do below changes.

<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

For more details, you can refer page#13-15 of the Web API PDF guide - https://sdn.sitecore.net/upload/sdn5/modules/sitecore%20item%20web%20api/sitecore_item_web_api_developer_guide_sc66-71-usletter.pdf