Restrict inbound connections to localhost where appropriate

[cpcallen]

Taking a belt-and-braces approach to the scans that were causing the problems underlying #360:

• Check each of codecity, loginServer, connectServer to ensure that JavaScript will drop connections from other than localhost.
  • Verify in particular that the eval server on port 9999 is protected.
• Set up kernel-level firewall rules to block access to those ports other than from localhost.