fix #4415
fix #4417
default listen on localhost for connections as changelog.txt already says:
- "by default listen to localhost:8452 now"
- to make it work BypassScriptPasswordCheck has to be set to 1
Merge remote-tracking branch 'origin/release' into develop