The service_user and group option were being locally overriden in the service

recipe and causing problems when being used with watch resources on centos. 
the workaround was to set the user and group explicitly to root.

To fix it i moved the logic for determining the user to use out to the 
attributes file.