Add notes about avoiding root
Defensive umask