I did not test D4102 well enough. When I actually got around to using it, I realized that placing special characters like / and . in environmental variable names does not work.

This diff does two things:

1. Makes sure we don't have any special chars in the names of the environmental variables
2. It improves the security by limiting access to facts and keyserver directories (assuming we can trust Flow)

I configured a .env that uses importJSON like this:

COMM_MYSQL_DATABASE=commdev
COMM_MYSQL_USER=commdev
COMM_MYSQL_PASSWORD=pass
COMM_JSONCONFIG_facts_landing_url='{"baseDomain":"http://localhost","basePath":"/commlanding/","baseRoutePath":"/commlanding/","https":false}'
COMM_JSONCONFIG_facts_commapp_url='{"baseDomain":"http://localhost","basePath":"/comm/","https":false,"baseRoutePath":"/comm/"}'