use more restrictive umask - closes #136