Change default settings to improve security

Disable cross_origin by default, change from 0.0.0.0 to localhost in config-defaults.