fix up config generation to allow more valid values

first of all, allow setting php_* values by removing the comments.
Second, add the security_limit_extensions config variable to make it configurable