Pleasantly surprised that onedriver's auth_tokens.json has sensible permissions.