+ has_permissions() to auth.py
all /server requests execute as the server owner.
fixed umask issue to umask(2) which is ug=rw,o=r