I would like to add the following topics as what you shouldn't do in production:
- Serve static assets not minified and gzip'ed (see grunt)
- Disallow local caching for those static assets
- Keep access logging enabled
- Store uploaded files on disk folders instead of a virtual file system like GridFS