only drop privileges if necessary