apache/incubator-brooklyn — pull request #154 by sjcorbett (2014-09-08 16:52:37+00:00)
Title: Brooklyn 51 

If no security properties are set and `--noConsoleSecurity` is not set then `BrooklynLauncher` configures the server to accept unsecured connections from `127.0.0.1` and secured external connections that are authenticated with the user `brooklyn` and a randomly generated password that is logged once.

The new security filter checks the remote address of the request. I'm assuming that this can't be spoofed.