dont allow external access to the server

[cfal]

although localhost is hardcoded in the URI when displaying the preview, the http server listens on all interfaces and would be externally accessible when not behind a firewall. this is a security risk. this PR changes it so that the server only listens on localhost.