enable unsafe tendermint rpc features, bind to localhost

[keppel]

/dial_peers endpoint requires unsafe mode for rpc. since only the lotion transaction and abci servers talk to the tendermint node, it's ok to run in unsafe mode as long as the tendermint node isn't exposed to the outside world.