Great point. I am working on adding an option for requiring a username/password to make this safe for production. It should be pushed in the next couple days.
If you make it listen on 127.0.0.1 only, you'll only be able to connect to it from a shell on the local machine, which will alleviate all of your security issues.
