allowing connections from localhost is not sufficient
but xhost + is less secure. A better solution should be found.