revoke most of www-data's write rights