Since the control port doesn't have a password yet, it would be good, security-wise, to bind the control port only to the loopback interface.
There could be a command line option to change the interface as well (though that's not my request).
To force it to the loop back interface, all we need is a single line change:
controlSocket = new ServerSocket(this.controlPort, 0, java.net.InetAddress(null))
controlSocket = new ServerSocket(this.controlPort)