pflask: add --keepenv option
tools: allow configurable sudo cmd