Call setgroups() before setgid/setuid

fixes #6659