*: small improvements
dockerfile: run tornado server as non-root