Besides being more correct, it protects against people accidentally
exchanging the permission and open mode arguments to Open.

R=rsc
CC=golang-dev
https://golang.org/cl/1904045