better error reporting
honor env when not issuid
provide O_NOFOLLOW if there is non
allow the non preauth case again
More strict fcache rules

- use O_NOFOLLOW
- be more strict not to follow symlinks
- require cache files to be owned by the user
- have sane permissions (not group/other readable)