restrict requests to localhost - respond with 403 for non-localhost requests
fix format specifier
replace copy of method with forward declaration
restrict requests with auth token - set on querystring for initial request, then set a cookie for subsequent requests
update security caveat in README
use indexPage consistently instead of hardcoded "index.html" string
Merge pull request #2 from tony--/localhost-only

Security improvements: localhost only + auth token