ensure private dir

* ensure that private directory is owned by us, if it already exists.
* factor out private tmpdir functionality
* provide a test for the locking