config files containing passwords shouldn't be world-readable

Change-Id: Ia05ba0c5622ae83eb7d01a00b1ee8aa98eb45e65