world writable user-specific files: just say no