Should these be owned by root instead of apache? It seems like we don't want apache to be able to write to these files, from a security standpoint, for the same reasons we don't want apache to have write access to the code it's executing.