don't require root -- if root, degrade to web user