fab: always pull as user (not sudo)