pw: do not call system()
Calling system makes pw(8) spawn a shell, which can then be abused.
MFC After: 3 days