(minor security change) restrict mongo to connections from localhost