Changed app.listen() call to include 127 IP to prevent external direct access by port. Now much be proxied via Nginx or Apache.