fix(controller): bind to private ipv4 address

The controller by default binds itself to 0.0.0.0. When we are in a
public cloud which exposes all ports by default, this means that the
controller will accept all incoming connections from anyone. This is not
intentional. The controller should only accept connections internal to
the cluster, and the router will expose the controller outside the
cluster.