force perm 400 when reading user files