Run carton as the user (not root)

fixes gh-45.