fix: bind auth callback listener only to localhost (#190)