tighter initial permissions for config.json and admins.htpasswd