Don't use exec()

I found this out by reading the source code - apparently a derpconf .conf file is actually a python file, and derpconf reads and executes it.

That's awfully insecure, given that local users might have access to write to the file.

In addition the `conf_name` and `lookup_paths` options allow loading the config from a list of paths rather than a well-defined absolute path, meaning that all an attacker has to do is be able to write a file into _one_ of the directories in the list to get arbitrary code execution.

cyclops uses this to load configs from `.` and `~` if a relative path is specified, which seems like a bad idea.

i'm not 100% sure on how to best solve this, but my 5minute 2-cents-worth: seems like most configs should be securely parseable using a very simple parser (read lines, split on `=`, then parse expressions using [ast.literal_eval()](https://docs.python.org/2/library/ast.html#ast.literal_eval) ). This would allow you to support a sane range of python expressions, without allowing arbitrary execution. It makes multi-line expressions a bit tricky though.