Fix the permissions of the temp file, otherwise a php instance started under a different user can't access it.
Add " to the characters that should be escaped by cherokee_buffer_escape_uri_delims

When rendering a directory listing a path on the filesystem could
have been used to inject javascript inside the directory listing.
This was possible because we do not escape " in the file entry.

Thanks a million to @blasphemy to reporting this issue!

Fix #1015