config: listen only on localhost

Tada should be only accessed from localhost until proper authentication/
security measures are implemented.