templating.renders 'fixes' directories to be world readable

templating.render accepts a mode argument, tricking the developer into thinking it might be secure, but then proceeds to reset the permissions of the parent directory to a hard coded world-readable:

   host.mkdir(os.path.dirname(target), owner, group, perms=0o755)

Directories should only be created in this fashion if explicitly asked for, rather than having potentially insecure behaviour by default.