security: Use `/var/tmp` safely

In a multi-user system, the testserver binary could have been written by another user and may be malicious. We should include the username in the path (either in the filename or as an intermediate directory; I think a directory might be a little safer) and verify that ownership and permissions are as expected.