Only allow connections to dev html client from localhost.

Need to think about security implications of allowing arbitrary ruby code
to be sent from any connection. Perhaps a whitelist or some sort of 
sandboxing.
Add Array#choose as an alternative to Array#sample