Improve security

- default host to "127.0.0.1"
- wait for server to listen before running appStarted callback