be safer (by quoting CFLAGS before exporting it)