The dist/assembly.xml file adds the tmp/auth directories for standalone and domain mode with limited permissions (because this directly contains the local authentication token files).

Due to what looks like a copy and paste error however the permissions are wrong for the standalone mode. I am not sure if it can be exploited, but it is wrong. I will send a Github pull request.