In order to guarantee a secure connection between apps and the LCD the
communication must be encrypted - even if clients and server run on the
same local machine, credentials must never be transmitted in clear text.
Upon start up, the server generates a self-signed certificate and a key.
Both are stored as temporary files; removal is guaranteed on exit.
This new behaviour is now enabled by default, though users are provided
with a --insecure flag to switch it off.