keep file serving bound localhost only