this should be run as the www-data user right?  Is that being enforced somewhere else or just missing here?