apache sites: Wrong ownership and filename

On Ubuntu 14.04 LTS, a2ensite (part of package "apache2-2.4.7-1ubuntu4") automatically appends ".conf" to the filename it looks for in /etc/apache2/sites-available/
Therefore, the file "/etc/apache2/sites-available/roundcube" must be renamed to
"/etc/apache2/sites-available/roundcube.conf". The same goes for the other virtualhost files in "/etc/apache2/sites-available/".

Security issue:
These files must be owned by root, otherwise it is a huge security issue (User www-data could modify the file once there is a tiny security hole in any of the webpages and get root at next restart of apache).