listen on localhost by default

see #10