More restrictive default permissions (fixes #16)