Enable security (optimally by default)

Thinking of the almost running gag of "Default security settings" of various servers (mongo, etc), I'd suggest that the default settings of imagej-server provide at least some basic security. Things to consider:

* basic auth (minimally), perhaps with a generated password. Alternatively, see the token generated by JupyterHub
* encryption (in Java requires some setup; alternatively something like NGINX with LetsEncrypt
* interface binding: only listen on localhost by default

No files or tests are named. Start by locating the server's default configuration and startup entry point, then clarify the desired basic authentication, encryption, and localhost-binding behavior; done means secure defaults are implemented and their behavior is covered and documented.

Written by the indexing model from the issue text.