by default, servers open to only localhost for security