More secure defaults.

Without config, listen only on looback interface. In sample config
listen on any interface, but use an IP whitelist.

Related to #950

js/defaults.js

@@ -8,7 +8,7 @@
  */
 
 var port = 8080;
-var address = ""; // Default to listening on all interfaces
+var address = "localhost";
 if (typeof(mmPort) !== "undefined") {
 	port = mmPort;
 }