Only allow access via localhost by default

This can be overridden via the "shiny.host" option or by explicitly
passing the host parameter to runApp/runExample.

As the NEWS says, this is a breaking change, probably worth some discussion before merging...?