That's my understanding, yes.  It follows from the general understanding that network-accessible daemons (with perhaps the exception of sshd) should not be accessible from outside of localhost by default. 

Now I'm curious... do you have a particularly strong reason why web apps should be different than any other network daemon?

--

Jared Smith