Only listen locally by default

Listening on all interfaces by default and not mentioning it
at all may leave some people use that default and expose
their certifiers publicly.

This makes it use a safer default and mentions it explicitly.

The ip/port declarations in the sample config were also moved
closer together.