Use start-stop-daemon --chuid option to setuid to www-data.