- install drupal modules/themes as root:daemon rather than www:www
(only the files/ directory needs to be writeable by 'www').
- don't install 'settings.php' world-readable since it contains the
DB password. Use 640, owner 'www' instead.
- bump all modules.
tested in production, including upgrade szenarios.
ok sthen@ and landry@, maintainer timeout.
in order to avoid lots of page loads.
Note that activating this module is not enough, you have to
also replace the menus (e.g., navigation) by their dhtml version
on the administer/menu page.