Plugin config should not be world-readable

Since plugins may contain things like passwords (e.g. postgresql), it doesn't really make sense to have all users able to read their config.