Should listen to localhost only by default

Can listen to all IP addresses by setting config or passing argument,
thus we should give the minimal authority by default.
Merge pull request #754 from changyuheng/pr-localhost-by-default

Should listen to localhost only by default