fixed CVE-2013-3709 (bnc#851116)

make the secret token file (secret_token.rb) readable only for
the webyast user to avoid forging the session cookie

- 0.3.46