set FD_CLOEXEC on server socket

So children don't inherit that file descriptor.