Use shell=False with Popen

This doesn't technically depend on the previous patch, but they both edit the same line of code, so there'd be a merge conflict if they were done separately.

Use of subprocess.Popen(shell=True) is dangerous and vulnerable; much safer (and, IMO, clearer) to use a list of arguments.