set up provision: create sudoer "provision" user with permissions to run provision only