fixed CVE-2013-3709 (bnc#851116)

make the secret token file (session_store.rb) readable only
for the webyast user to avoid forging the session cookie

- 0.3.12.1