I'm presuming by not being able to later remove them,
you mean from your user account (that is, not from
apache's account). Remember that apache runs your cgi as
a different user than you log in as. Because of that,
there's no way for apache to know that it's ok for your
CGI to give files to you.