fix(web-server): bind only to localhost

It's better to bind to localhost only during development, since it improves security. It also avoids a pesky warning under Mac OS.