Drop privileges so we can listen on :80 without being root

This was much harder than I expected because of the need to pass
a the ("privileged") file descriptor to the child when we reload :(.

That was hard because it turns out that go's garbage collector closes
file descriptors on our behalf if we aren't careful.