document a known PHP bug whose fix was rejected
httpd: disable per-group cgi-bin by default (CVE-2014-6275)

Conflicts:
	src/cronjobs/homedirs.php
several more places where we can disable cgi-bin for CVE-2014-6275