better drop_privileges