drop privileges before forking