detect php cgi binary because people keep trying to run service scripts using it