Don't override the user's FLAGS

Fedora for instance sets -fstack-protector-strong
but we override that with -fstack-protector, which is less secure

Ideally we never touch CFLAGS, CXXFLAGS and the like but fixing
that is an exercise left for the reader.
Merge pull request #1789 from rubenk/dont-override-user-cflags

Don't override the user's FLAGS