加强Elasticsearch HTTP API安全性

[zmy]

目前HTTP API没有访问限制，添加删除都能公开操作。应该只公开只读接口。

Reference:
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/api-conventions.html
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/url-access-control.html

[cgcgbcbc]

bind ip应该最安全吧？