Should listen to localhost only by default

Can listen to all IP addresses by setting config or passing argument,
thus we should give the minimal authority by default.