Listen for only localhost requests.

Serving requests only from localhost, as the api is running behind
apache's reverse proxy.