remove unused command-line option --no-password (should implement it later).  use 127.0.0.1 for the origin host to avoid CORS complaints from ipython.