boxcars: drop privs to nobody