MongoDB 3.6 major security vulnerability

@malex thanks for posting; please see Limiting MongoDB to localhost for a response.