set perms of .env to 0600 on init

This patch sets the perms of `.env` to `0600` (read-write by owner only) if `bin/setup` is creating the file for the first time. Otherwise. `.env's perms will be determined by the user's umask which may not be appropriate for a file that could potentially contain creds.

As a data point, Ubuntu's default umask is `0002` which results in world-readable files.