per request #6, add option localhost_only to limit listening interface, better security