clean up tempfile module and rm FIXME

This removes the FIXME suggesting that mkdtemp should rely on the
default umask, because that would make it unusable for making a secure
work area in a world writable directory (have to assume that other users
have created files, directories, hard links, etc. in your directory).
The POSIX mkdtemp function creates a directory with 700 permissions to
avoid this problem.

I can't really think of a use case for a randomized directory name which other users have read/write permissions on. If there is some edge case, it can be dealt with by doing a chmod after the fact (but you can't do the security retroactively).

Closes #2349.