serve only from localhost by default