Use 'brandrpm' user and give up on trying to tighten security.  Yay.
Try allowing assets to compile, to fix 500