- strengthen default permissions on socket
- document per-app socket naming intention