Correct ntpd restrictions.

New default would:

 - Deny runtime reconfiguration from remote;
 - Deny ntpq(8) and ntpdc(8) queries.  Time service is not
   affected.
 - Deny packets which would result in mobilizing a new
   association.
 - Decline to provide mode 6 control message trap service.

With exception of loopback addresses.