Better error reporting on unreadable client files, group loose umask and file perms to allow webserver access

Changed "temp" to "tmp", originated as mental typo (should not cause problems as filer ensures directory creation itself)

The lowest last id  client can get ever have is 1 (0 is special), so first event must be 2, otherwise event with id 1 may get lost (thx bodik@cesnet.cz)

Cert checking now works correctly in both "SSLVerifyClient required" and "SSLVerifyClient optional" (authenticators do safety check themselves)