tempname: use secure_getenv