Security concerns with background server

[0xbrayo]

The new version #139 will expose the API under localhost:5600all the time. Protected by CORS in the browser but vulnerable to apps running natively in the device.