parse_arguments: never parse sys.argv directly