That is just what I was going to say.  We don't start serving connections until after the permissions have been changed.