spawn with sudo

instead of setuid

allows better restricted access, and doesn't require the server to be run as root.

still a work in progress, because restricting sudo while allowing it to still do enough on behalf of users is a pain.

Open question to folks with more sysadmin chops than me (@aculich, @rgbkrk):

**What is a reasonably restrictive way to run the server process with the ability to spawn single-user servers as other users, but limiting other abilities?**

I've got PAM set up, and I can restrict sudo with:

    jupyterhub ALL=(list, of, users) NOPASSWD:/usr/local/bin/jupyterhub-singleuser

in `/etc/sudoers`.

The last piece of the puzzle is that I set secure values, like the cookie secret and API key, with environment variables, but this sudo setup doesn't allow passing environment variables to the subprocess.

I have it working with this line in sudoers:

    Defaults!/usr/local/bin/jupyterhub-singleuser env_keep = JPY_*

But that doesn't allow the parent application to pass any further environment variables. Maybe that's a good thing? Any help with this aspect would be great. I don't like running public-facing services as root.

I've written up some steps to get restricted sudo working [on the wiki](https://github.com/jupyter/jupyterhub/wiki/Using-sudo-to-run-the-server-as-non-root).