more reliable way to look up username

`ENV` is manipulable.  `getpwuid` is reliable.