Check file permissions even when we get full path over FastCGI

It's not a security issue (executing the file would fail, anyway)
but it's a sensible sanity check.
Fix 403 error handling

Report 403 errors over normal stdout/stderr (after setting up the
pipes). Properly reporting the error response over stdout requires:
 - flushing the I/O, which would otherwise get buffered
 - skipping atexit handlers (would otherwise close the FCGI connection
   cleanly, interfering with the parent process still trying to talk
   over it)
Unify CGI error handling

Use the same error handler for 403s and 502s. This basically ports
the required fixes from error_403 (previous commit) to the 502
error on failed exec(). Two user-visible side effects:

 - error message now says "403 Forbidden" instead of "403"
 - failed exec() gets logged over stderr

(also, use \r\n instead of \n as a line seprator but that has been
fixed up by the parent process before).
Close FCGI socket before executing script

We do it in a rather violent way to avoid FCGI shutdown (the parent
must keep the socket alive and working)
Add help for -f option
Bump version number