dnsmasq now only listens on localhost.

Because it really doesn't need to listen on more than that for our purposes.