Only allow connections from localhost

This is a security thing, otherwise anyone on your network
could see potentially sensitive code.

This restriction may be disabled by setting `config.onlyAllowLocalhost` to `false`.