config: add option to drop priviliges