fix #394. this cleans up some handles after using them, and doesn't disable ALL process privileges upon success