problem: don't want to run my server as root to bind to privileged ports (e.g. 80, 443).
solution: support privilege drop after socket bind via new --user <username> parameter.
add support for loading CA bundles

fix loop

typo

another typo *sigh*

this wasn't doing what I thought it was doing.