Switch to spawn for safer execution.

spawn is explicit execution instead of using exec's shell parsing.

In theory, that should make it harder to exploit.