more strict spooldir permissions to avoid world access