Here's the issue -- one cannot run a TabPy instance within a secure network listening only on 127.0.0.1 / localhost to ensure that only a Tableau Server running standalone on the same host will be the only one able to mediate interactions.

Furthermore, this lack of capability doesn't allow for one to bind a TabPy instance to specific IP (a technique used for restricting access to a specific network interface card).

A brief look shows that the arrow server is hardcoded to 0.0.0.0 and there's no address=... passing to Tornado's Application.listen(port, ...) function.