add privilege dropping