Should listen to localhost only by default

Can listen to all IP addresses by setting config or passing argument,
thus we should give the minimal authority by default.
Change the built-in server ip config to localhost

This is an additional patch for #754.