jenkins - Hiding hudson behind apache

Question

I'm pulling my hairs out on this one. I'm running Hudson on a server and want to place it behind an Apache running on Ubuntu. So I installed the apt sources and the Hudson package and it is up and running.

I have it configured to only listen on localhost, but apparently this is ignored. The run command is:

/usr/bin/java -Djava.net.preferIPv4Stack=true -jar 
         /usr/share/hudson/hudson.war --webroot=/var/run/hudson/war 
         --httpPort=7000 --httpListenAddress=127.0.0.1

and here's the big BUT

netstat -tulpn | grep 7000

returns:

tcp        0      0 0.0.0.0:7000        0.0.0.0:*       LISTEN      27525/java

So it's still listening on the public address.

my /etc/default/hudson looks like this:

NAME=HUDSON
JAVA=/usr/bin/java
PIDFILE=/var/run/hudson/hudson.pid
HUDSON_USER=hudson
HUDSON_WAR=/usr/share/hudson/hudson.war
HUDSON_HOME=/home/dev

RUN_STANDALONE=true
HUDSON_LOG=/var/log/hudson/$NAME.log
MAXOPENFILES=8192
HTTP_PORT=7000
AJP_PORT=8102
HTTP_HOST=127.0.0.1
HUDSON_ARGS="--webroot=/var/run/hudson/war --httpPort=7000 
                                         --httpListenAddress=127.0.0.1"

What am I doing wrong?