listen on port 80, run as root, drop privs