Allow the puppetca proxy to run "puppet cert" as root.