overhaul

did too many changes to mark incrementally, but figured out CGI post
payload is just stdin and user path expansion does not happen
automatically in a python shell.