I also have had success in using the following: ControlListenAddress 127.0.0.1:9051 Which binds the control port to 127.0.0.1 (localhost) and is thus not visible to the outside world. (Including the people on the internet port scan you just for running a Tor node.)
Or set 'ControlPort 9051' - binding to localhost is the default. This is all discussed in the README... https://gitweb.torproject.org/arm.git/blob/HEAD:/README
Patches welcome if you have improvements for it. -Damian