Disable web server by default and make it enabled by attribute

(cherry picked from commit 429f73584a9dd849e2a0753f67f5e8a474e18786)
Signed-off-by: Christopher H. Laco <claco@chrislaco.com>
Lock down the http interface a little more

The original PR was to enable/disable the http support to narrow the
attack surface, with a default of false (not enabled). The http support
is required for the command line utility, which is uses in the current
gating process.

As a compromise, we'll enable http to enable the command line but lock
down the binding/allowed addresses to localhost by default.

Fixes rcbops/chef-cookbooks#609
Merge pull request #34 from claco/http-optional

Merged automatically by jenkins after successful build test