Fixed: set attributes AFTER file is created.
Added: security checks for admin tasks.