Do not export prometheus metrics by default

Per discussion with @feld, also need to add ability to restrict access to whitelisted IPs.