update wrappers once we update (mainly drop) privs