Be more strict about file permission masks

Set a reasonably strict umask  of 0022 when creating most files and
directories. Also set the umask to 0077 for private files to avoid a
brief race where someone could open them for reading after creation
but prior to the prophylactic chmod to 0600.