Change server.listen default address

docs/server.md

@@ -80,8 +80,15 @@ Example:
 `listen(port, [host], [callback])`
 
 Begin accepting connections on the specified port and host. If the host is
-omitted, the server will accept connections directed to any IPv4 address
+omitted, the server will accept connections directed to the IPv4 address
-(INADDR\_ANY).
+`127.0.0.1`. To listen on any other address, supply said address as the `host`
+parameter. For example, to listen on all available IPv6 addresses supply
+`::` as the `host` (note, this _may_ also result in listening on all
+available IPv4 addresses, depending on operating system behavior).
+
+We highly recommend being as explicit as possible with the `host` parameter.
+Listening on all available addresses (through `::` or `0.0.0.0`) can lead
+to potential security issues.
 
 This function is asynchronous. The last parameter callback will be called when
 the server has been bound.

lib/server.js

@@ -701,13 +701,13 @@ Server.prototype.after = function () {
   })
 }
 
-// All these just reexpose the requisite net.Server APIs
+// All these just re-expose the requisite net.Server APIs
 Server.prototype.listen = function (port, host, callback) {
   if (typeof (port) !== 'number' && typeof (port) !== 'string') { throw new TypeError('port (number or path) required') }
 
   if (typeof (host) === 'function') {
     callback = host
-    host = '0.0.0.0'
+    host = '127.0.0.1'
   }
   if (typeof (port) === 'string' && /^[0-9]+$/.test(port)) {
     // Disambiguate between string ports and file paths