app: setuid to www in production