more reasonable permissions on config files

this way the webserver don't own the files (so can't change perms) yet can still read